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(U//FOUO) THIS DOCUMENT CONTAINS INFORMATION FROM 
FOREIGN INTELLIGENCE SURVEILLANCE ACT (FISA) COLLECTION. THIS 
INFORMATION, AND ANY INFORMATION DERIVED THEREFORM, MAY NOT 
BE USED IN ANY FOREIGN OR DOMESTIC CRIMINIAL, ADMINISRATIVE, OR 
OTHER PROCEEDING WITHOUT THE ADVANCE AUTHORIZATION OF THE 
ATTORNEY GENERAL. IF CONCERNING U.S. PERSON(S), THIS 
INFORMATION MAY BE DISSEMINATED TO A FOREIGN GOVERNMENT ONLY 
WITH PRIOR AUTHORIZATION FROM FBIHQ. ANY REPRODUCTION, 
DISSEMINATION, OR COMMUNICATION (INCLUDED BUT NOT LIMITED TO, 
ORAL BRIEFINGS) OF THIS INFORMATION MUST BE ACCOMPANIED BY A 
STATEMENT OF THESE RESTRICTIONS. 


(U//FOUO) ALL CLASSIFICATION MARKINGS IN THIS REPORT ARE 
BASED ON THE DESIGNATIONS OF THE AGENCIES THAT PROVIDED 
INFORMATION TO THE OIG FOR THIS REVIEW. THE OFFICE OF THE 
DIRECTOR OF NATIONAL INTELLIGENCE COORDINATED THIS 
CLASSIFICATION PROCESS AND CONVEYED THE CLASSIFICATION 
DESIGNATIONS TO THE OIG, AND THE OIG INCORPORTATED THOSE 
DESIGNATIONS INTO THIS REPORT. 
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(U) EXECUTIVE SUMMARY’ 


I. (U) Introduction 


о The Foreign Intelligence Surveillance Act of 1978 
Amendments Act of 2008 (FAA) was signed into law on July 10, 2008. The FAA 
was enacted as part of Congress’s effort to modernize the Foreign Intelligence 
Surveillance Act of 1978 (FISA), codified at 50 U.S.C. §§ 1801-1885. 


99755540). The FAA followed earlier efforts to enhance the nation’s 
ability to gather signals intelligence in the wake of the terrorist attacks of 
September 11, 2001. In October 2001, the President authorized a highly 
classified program, known as the President’s Surveillance Program, to conduct 
electronic surveillance of certain communications into and out of the United 
States without seeking orders from the Foreign Intelligence Surveillance Court 
(FISA Court).2 Beginning in 2004, this program was transitioned in stages to 
FISA Court supervision through a series of FISA orders. However, according to 
a former senior Justice Department official familiar with these events, in May 
2007, the FISA Court imposed rigorous procedural requirements on the 
government’s foreign surveillance authority, causing the National Security 
Agency (NSA) to place fewer foreign selectors under coverage than it wanted to.? 
To address concerns that (TS) 
Congress enacted the Protect America Act of 


1 (U//FOUO) At the FBI’s request, we provided a previous draft of this report to the 
FBI so that it could conduct a privilege review before the draft report was circulated to other 
agencies. Unless otherwise indicated, redactions to this final report are based on the 
Department of Justice’s assertions of the attorney-client privilege. The FBI has also requested 
the following notice: 


(U//FOUO) This report contains FBI information that belongs to the FBI and 
may not be disseminated further without express authorization by the FBI. If 
authorized, any dissemination of this information must be made on a strictly 
need-to-know basis and is not considered a release to the public. Information 
determined to be exempt under FOIA (5 U.S.C. § 552 as amended by the OPEN 
Government Act of 2007), or any other privilege, including, but not limited to 
information protected by the deliberative process privilege, remains exempt or 
privileged under a limited release to other members of the Intelligence 
Community (“IC”) and Congress. As the report is classified TS/SCI, the report or 
any portion thereof can be released only to individuals with the requisite 
national security clearance and a need to know. 


2 (U//FOUO) The FISA Court was established under the FISA statute to review the 
government’s applications to exercise FISA authority and grant orders approving such 
applications. 50 U.S.C. § 1803. 


3 ક A “selector” is either a telephone number or an identifier used for Internet 
communications, such as an e-mail account. 
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2007 (PAA), a temporary legislative measure designed to streamline collection 
of foreign intelligence from targets located outside the United States.. The PAA 
expired on February 16, 2008, and Congress thereafter enacted the FAA, key 
provisions of which are set to expire on December 31, 2012. 


Въча, Section 702 of the FAA generally governs Ше acquisition of 
foreign intelligence information from or with the assistance of an electronic 
communications service provider by targeting non-United States persons 
reasonably believed to be located outside the United States. Acquisitions under 
Section 702 are conducted through electronic surveillance or a search of stored 
communications.^ 


(U//FOUO) This report describes the Office of the Inspector General's 
(OIG) review of the Federal Bureau of Investigation's (FBI) activities under 
Section 702 of the FAA. The OIG assessed the FBI's policies and procedures 
for conducting targeting and post-targeting activities under Section 702 from 
September 2008 through early 2010. As required by Section 702)()2( and (3), 
the OIG also reviewed the number of targets that were later determined to be 
located in the United States at the time of acquisition and the number of 
disseminated intelligence reports containing a reference to a U.S. person 
identity, including identities disseminated in response to requests for U.S. 
person identities not referred to in the original reporting. 


(U//FOUO) To conduct its review, the OIG interviewed approximately 45 
individuals, including FBI personnel who administer the 702 Program and 
senior FBI officials in the Counterterrorism Division and Office of General 
Counsel. We also interviewed attorneys in the Department of Justice's National 
Security Division (NSD), and officials in the National Security Agency (NSA) and 
the Office of the Director of National Intelligence. In addition, we reviewed 
thousands.of documents related to the FBI's 702 activities and conducted 
various statistical and other analyses based on data provided to us by the FBI 
and other agencies. 


4 SP As used throughout this Executive Summary and the report, “electronic 
surveillance” generally refers to the interception of electronic communications as they are 
transmitted. A search of “stored communications” generally refers to the acquisition of 
electronic communications that are in electronic storage, such as on an Internet service 
provider’s (ISP) servers. 
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II. (U) Background 
A. (U//FOUO) Section 702 of the FISA Amendments Act of 2008 


(U//FOUO) Section 702(a) of the FAA authorizes the targeting of persons 
reasonably believed to be located outside of the United States to acquire foreign 
intelligence information, without an individualized FISA Court order.5 


(U//FOUO) The affirmative authorization contained in Section 702(a) is 
limited by several prohibitions set forth in Section 702(b). The chief prohibition 
is that an acquisition authorized under Section 702(a) may not intentionally 
target a United States person.£ Section 702(b) also prohibits the intentional 
targeting of any person *known at the time of acquisition to be located in the 
United States,” and the intentional targeting of a person “reasonably believed to 
be located outside the United States if the purpose of such acquisition is to 
target a particular, known person reasonably believed to be in the United 
States" - the prohibited practice commonly referred to as “reverse targeting." 


(U//FOUO) The requirements of Section 702 that the acquisition target 
non-United States persons reasonably believed to be located outside the United 
States at the time of acquisition form what the Intelligence Community 
commonly refers to as the “foreignness” requirement. The foreignness 
requirement is designed to ensure that all persons located in the United States, 
and United States persons located anywhere, are afforded the protections and 
procedural requirements for acquisitions under other sections of the FAA and 
the individualized court order provisions of traditional FISA. 


(U//FOUO) Section 702(c) requires that acquisitions made pursuant to 
Section 702(a) must conform to targeting and minimization procedures adopted 
by the Attorney General, in consultation with the Director of National 
Intelligence. The targeting procedures must be reasonably designed to meet 
the foreignness requirements of Section 702, and the minimization procedures 
must meet the statutory rules in FISA that apply to information acquired 


5 (U//FOUO) Section 701(a) incorporates the same definition of “United States person" 
as provided in Title I of FISA: 


(U) *United States person" means a citizen of the United States, an alien 
lawfully admitted for permanent residence . . . , an unincorporated association a 
substantial number of members of which are citizens of the United States or 
aliens lawfully admitted for permanent residence, or a corporation which is 
incorporated in the United States, but does not include a corporation or an 
association which is a foreign power, as defined in subsection (a)(1), (2), or (3) of 
this section. 


(છું 50 U.S.C. 8 18016). 


$ (U//FOUO) The procedures for targeting United States persons outside the United 
States under the FAA are set forth in Sections 703 and 704 of the Act. 
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through electronic surveillance and physical search. Section 702(g) requires 
the Attorney General and the Director of National Intelligence to file written 
certifications with the FISA Court attesting to the fact that appropriate 
targeting and minimization procedures are in place, with copies of the 
procedures attached.” These certifications are subject to judicial review and 
provide the primary mechanism by which the FISA Court conducts its judicial 
oversight of the implementation of Section 702. 


(TS) 


Ы, b3, 
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(U//FOUO) Section 702 also requires extensive reporting and oversight 
concerning activities authorized under the statute. Section 707(b)(1) requires 
the Attorney General to provide Congress with a Section 702 Semiannual 
Report that includes: 


e (U//FOUO) all certifications submitted during the reporting 
period; 


e (U//FOUO) the reasons for the exercise of any exigent 
circumstances authority under Section 702(c)(2); 


e (U//FOUO) any directives issued during the reporting period and 
a description of any action taken to enforce them; 


e (U//FOUO) a description of any judicial review of the certifications 
and any targeting and minimization procedures during the 
reporting period; 

e (U//FOUO) copies of any compliance review conducted by the 
Attorney General; 


e (U//FOUO) copies of any procedures implementing Section 702; 
and 


е (U//FOUO) a description of any incidents of noncompliance by the 
Intelligence Community or by the providers. 


7 (U//FOUO) Unlike traditional FISA applications seeking authority to conduct 
electronic surveillance within the United States, the certifications are “not required to identify 
the specific facilities, places, premises, or property at which an acquisition authorized under 
subsection (a) will be directed or conducted.” Section 702(g)(4). 


T ISA 
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Section 702(9(1) requires the Attorney General and the Director of National 
Intelligence to conduct semiannual assessments of the ЕВГз compliance with 
its targeting and minimization procedures. Section 702()(2)(B] and (C) requires 
the Inspector Gencral to review certain FBI activities related to U.S. persons. 
Section 702()(3)(A} requires the Director of the FBI to also conduct annual 
reviews of certain FBI activities concerning U.S. persons. 


B. (Б//МЕ) Roles of the FBI, the NSA, and the CIA in the 702 
Program 


+ The FBI and the NSA are the only agencies authorized to 
acquire foreign intelligence information under Section 702, The Central 
Intelligence Agency (CIA) participates in Section 702 targeting activities by 
submitting its targeting requests to the NSA. The NSA is the lead agency in the Bl 
702 Program and during the OIG’s review period was the only agency with the 3 
formal authority to initiate electronic surveillance B7E 
מו‎ г: PISA Court-approved FAA procedures. Thus, durin 
our review period, the NSA iniliated all such electronic surveillance 
searches, although sometimes the NSA did so on behalf of the 
CIA or at the request of the FBI. 


(S) 


BAN The basic roles and division of responsibilities among the FBI, 
the NSA, and the CIA are set forth in a Memorandum of Understanding that 
the three agencies entered into in April 2008, after the PAA expired and before 
the FAA was enacted. 


ANA The FBI conducts two general activities under Section 702. 


(5) 

I | BI 

Before approving the NSA’s requests, the FB] must review information about B3 
the foreignness of the presumed user of the designated account to ensure that ც-ს 


the targeted user is a non-U.S. person reasonably believed to bc located outside 


the United States. When the NSA sccks to acquire the NN 
communications of designated targets, the FBI provides technical assistance 


only, and plays no role in approving the NSA's targcting decisions. Second, the 
FBI acquires both ранна froni the participating 
providers and routes the raw unminimized data to the NSA and, at the NSA’s 


direction, to the CIA and to the FBI's 


$ (ВАДА As noted, a “selector” is either a telephone number or an identifier used for Bl 


internet communications, such as an e-mail account. Because the FBI’s targeting activities B 
under the 702 Program are limited to acquirin from (S) 3 
domestic electronic communications service providers (usually Internet service providers), the B7F 


term “selector,” as used throughout this report, refers to an identifier for Internet 
communications, such as an e-mail address. 
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5 
—rrnir' --. ...... : ` 
portion of the raw data for analysis and dissemination as finished intelligence 


products, 


{SHANE} These two basic activities, which are discussed below and in 
detail in Chapters Three and Four of the OIG’s report, are carried out b 
crsonnel in the Counterterrorism Division's 
These personnel are drawn primarily from the 


We refer 
the FBI’s 


The 702 Team also works closely with attorneys 
from the FBI Office of General Counsel (OGC}, including attorneys we refer to 
in this report as the Operations Attorney and the Policy Attorney. 


III. (U) The FBI's Targeting Activities Under Section 702 


The FBI’s primary role in the 702 Program is to acquire the (5) 
This process 
begins with the NSA’s determination, based on intelligence from other agencies 
and its own analysis of signals intelligence already collected, that the MN 
E a selector (typically an e-mail address) may yield foreign 
intelligence information. The NSA applies its FISA Court-approved targeting 
procedures to determine that the account is used by a non-U.S. person 
reasonably believed to be located outside the United States. 


425-66-54} The NSA may apply its targeting procedures to target a 
selector for clectronic surveillance, nominate a selector to the თ“ 


માસ સર When the NSA targets a selector for 
electronic surveillance, the FBI, through . provides technical assistance 
only. When the NSA nominates a ии 
the 702 Team must first apply the FBPs own targeting procedures before 
conducting the 


SF The NSA nominations are (S) 
forwarded to the 702 Team in two ways: (1) by “selector sheets” that are e- ` 


mailed to the 702 Tcam cach day, and (2) through an FBI system called PRISM, 
(The CIA receives PRISM informatio ) | 
xiv 
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A. (U//FOUO) The FBI’s Targeting Procedures 


TS The 702 Team’s analysts are responsible for applying the FBI's 
FISA Court-approved targeting procedures to the nominated selectors. The b1, b3, 
work of these analysts is reviewed by supervisory special agents or the BE b7E 
Unit Chief, and in some instances, by attorneys in the Office of General 
EN and officials in the NSD, for a final determination as to whether a 


(5 ШЕШ can proceed. To implement the general requirements of its targeting 
procedures, the FBI developed —— AN с 
(S) which provide the 702 Team step-by-step procedures for 


S 
= the FBI has two primary obligations under its targeting 0 bl. b3 


procedures. First, the FBI must review and evaluate the sufficiency of the b7E 
NSA’s explanation for its reasonable belief that the user of the nominated 

account is located outside of the United States, and the information that the 

NSA provides concerning the user’s non-United States person status. The 

targeting procedures state that this sufficiency review will be done “in 

consultation with” the NSA. 


1550) The second of the FBI’s two primary obligations under its 


rocedures (S) 3 
b7E 
require the FBI to conduct 
PASA The targeting procedures do not obligate the FBI to conduct an 
independent, de novo analysis of a target’s U.S. person status and location. 
Rather, unless the FBI (S) 
the FBI’s targeting procedures state that “the FBI will acquire 81. 83 
In addition, the b7E | 


targeting procedures state that the “NSA will... be responsible for determining 
that a significant purpose of the acquisition is to obtain foreign intelligence 


ХУ 
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information." In view of these provisions, the 702 Team approaches its 
targeting rcsponsibilities with considerable deference to the NSA's targeting 
judgments. 


(U//FOUO) We concluded that overall the ЕВГв 702 Team has 
implemented its targeting procedures with commendable deliberation, 
thoroughness, and professionalism. Our more specific findings regarding the 
FBI's targeting activities are summarized below. 


1. 5778) Findings and Recommendations Relating to the 
FBI’s Review and Evaluation of the Sufficiency of the 
NSA’s Foreignness Determinations 


455-0485 The FBI's review and evaluation of the sufficiency of NSA’s Bl 
foreignness determinations is a critical step in the FBI's approval 
; : =: : B3 
process because for approximately two-thirds of all NSA nominations in the B?E 
OIG's revicw period, the FBI uncovered no information (S) 
about the account or its presumed user, and thus approved NSA 
nominations based solcly on the NSA's foreignness determinations. 
(5) 
Bi 
B3 
В7Е 
а. (SNF) The ЕЕЕ Factor (5) 
הס‎ The OIG determined that approximately 8 percent of Bl 
nominations submitted to the ЕВ! during Ше OIG’s review period were based НЗ 
on th factor, which is defined in the FBI’s SOPs as follows: В7Е 
(15) 
ч (ЗА) After reviewing a draft of this report, the NSA objected to this 
characterization of the FI’ authority to the extent it suggests that the NSA lacks the 
fundamental authority to acquire pursuant to Section 702. 
xvi 


FOPSECRET//BH /NOFORN/FISA 


TOP SECREFFFSITTNOFURNFFISA- 


TS 
> bl, b3, 
b7E 


TS) 
bl, b3, 
b7E 


(TSZZSt/ RE). However, the OIG reviewed pleadings, memoranda, 
ყვა е and court opinions provided by the NSD establishing that, in 
multiple contexts other than the FAA, the FISA Court has previously approved 


TS 
(T9) b1, b3, 
b7E 


ઉક્ત The documents we reviewed also included an August 2008 
filing with the FISA Court in support of the first FAA certification 
demonstrating that the FISA Court was aware of the NSA's use off rs) b1, b3, 
to establish foreignness. NSD officials told the OIG that they are 7E 
confident the FISA Court is aware that, using the factor in the (TS) 
context of the (TS) 


to establish its reasonable belief that the 


user of a designated account is located outside the United States at the time of 
acquisition. 


5 
b1, b3, 
b7E 


10 ТР. The NSA’s targeting procedures remained unchanged throughout the OIG’s 
review period. 
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eee b1, b3 
S М > 
(8) b7E 


(БУЕ) Notably, senior members of the 702 Team suggested that the 
FBI may interpret o tor more strictly if it uses this factor to 59 b1, b3, 
support its own nominations in the future. The OIG agrees that the FBI shoul b7E 
carefully consider how it intends to use the וו‎ factor, if at all, when(S) 
it assumes the responsibility of nominating its own selectors for 702 coverage. 


b. છું НЕН : 1 Explanations b7E 


558 The OIG also determined that approximately one percent of NSA 
nominations were predicated on foreignness explanations that used data older 
than one year. FBI witnesses generally agreed that foreignness information 
that was at least one year old raised questions about the sufficiency of the 
NSA's foreignness determination, yet the OIG found no indication that the 702 
Team ever contacted the NSA for additional, possibly more recent information 
when asked to approve such nominations. 


Both the NSA and the FBI told the OIG that the information on 
the NSA’s selector sheets represents the most current information available to 
the NSA at the time of nomination. However, we determined that the NSA 
sometimes develops more recent information about a targeted user's eligibilit 
for 702 coverage after the nomination has been submitted "€" | (S) b1, b3 
We therefore recommend that the FBI b7E i 
consider issuing guidance advising when the 702 Team should seek more 
current information from the NSA about a targeted user’s eligibility for Section 


702 coverage. This guidance should ensure that the FBI’s requests to the NSA 
for more current information will be made in a consistent manner. 


2. Findings and Recommendations Relating to the 4) 55 
FBI’s (S) b7E 


(ONE) The second of the FBI’s two primary obligations under its 
targeting procedures is to Www 


The targeting procedures require d 
the FBI to conduct these (S) 
FBI Targeting 
Procedures, 9 4. 
b1, b3, 
b7E 


xviii 


bl, b3, 


b7E 
follow in conducting its bl, b3, 
Each s of the process 1s I b7E 
Generally, the J require the 702 Team’s analysts to 
b1, b3, 
b7E 
b1, b3, 
b7E 
b1, b3, 
b7E 
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bl, b3, 
b7E 
bl, 
b3, 
b7E 
(S) 
bl, b3, 
b7E 
According to the Lead 
Program Coordinator for the 702 Team, this enhanced has (S) 
been incorporated into the training that 702 Team personnel must complete 
before they may conduct and will be added to a forthcoming (s) 
updated version of the (S) 
b. (U//FOUO) Documentation of Targeting Activities 
(S) 
along with the selector sheet bl, b3, 
and the completed checklist, in a selector file. As discussed below, the b7E 
contents of the selector file form the basis for the decision whether to approve 
the NSA’s request to conduct for the (S) 
nominated selector. The OIG found the 702 Team's documentation of its 
targeting activities to be extremely thorough and well-organized. bl, 


b3, 


с (87790) сар El с b7E 


4877989 We identified опе gap іп the 702 Team’s procedure for 
| that we believe can readily be remedied to improve the quality of the FBI’s 
targeting activities at very little cost in terms of time or resources. Under the 


(S) 


b1, b3, 
₪ b7E 


(S) 


хх 
ТОР 8 
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Br. Taking into account the volume of selectors nominated by the 
NSA and the complexity of the FBI’s we concluded that the (s) bl, 


FBI’s ERE añaki were conducted with the reasonableness (s) b3, 
required by the targeting procedures, and that the FBI met this standard of b7E 


diligence consistently throughout our review period. 


(TS) Ы, 
b3, 
b7E 


bl, 


b7E 
4. (U//FOUO) Planned Implementation of FBI Nomination 
Activities 
ST TREY As discussed in Chapter Two of the OIG’s report, the FBI plans 
to greatly expand its role in the 702 Program in 2012 by nominating selectors 
for Section 702 coverage. 
bl, b3, 
b7E 
bl, 
b3, 
b7E . 


57798) During the OIG's review period, several procedural and 
technical issues remained to be worked out before the FBI could begin 
nominating selectors, which witnesses told us was expected to begin in early 
2013. While finalizing this report the OIG learned that the FBI began 
nominating its first selectors in April 2012. 


B. (SPIEL Findings and Recommendations Relating to Selectors 
Used by Persons Who Have Traveled in the United States 


TSZ*Nfj- The OIG’s review of the FBI’s application of its targeting 
rocedures included an assessment of how the FBI processed nominations b1,b3, 
The FBI’s targeting procedures (S)  b7E 
impose no obligations on the FBI regarding accounts used by persons who are 
found to have traveled in the United States prior to a 


However, in late 2007 the ODNI Civil Liberties Protection 
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Officer raised concerns that th 


48/4NE} To address these concerns, the FBI implemented a special 
review process for nominations involving targeted users who have 


Bl 
B3 
B7E 


(S) 
During the OIG's review period, the FBI’s OGC consulted with attorneys in the 
NSD when conducting these reviews. 


4TS//SL ANF} The OIG identified approximatel that had 
been subject to some level of FBI analysis for our review (15) 
period. We determined that the FBI never rejected a nominated selector based 
explicitly on concerns during the review period. We also 
conducted a careful review of selector files and concluded that although the Bl 
OGC collected all the information relevant to making B3 
determination for each selector il reviewed, there did not appear to be a B7E 
discernable set of principles guiding the FBI OGC’s analysis of 


However, we believe that the 
process was not a meaningless exercise. The NSA 
selectors after learning that the FBI had found recent 
| - by the target and would be submitting the nomination to the FBI OGC 
for review. 


4ISZ/SLLLNE) The OIG also analyzed nominations for (TS) 
ing targets who had 


xxii 


bl, b3, 
b7E 


(ფუ წა. The FBI and other participating agencies have initiated a 


bl, 


reassessment of the FBI’s review process for nominations involving selectors b3 
used by persons who have თ.“ DENEN The OIG (S) b7E 
believes that this reassessment should continue, and that the FBI should 
consider the following factors. 


BPA First, we believe that the review process need not be inflexibl 
invoked for all nominations that involve 


(S) 


Second, meaningful FBI bl, 
OGC scrutiny should be applied to nominations involving targeted users with a b3, 
(5) b7E 
Third, FBI OGC review 
should be required as part of any FBI plan to nominate accounts for a (S) 
under Section 702 where it has been determined (s) 
that the presumed users 
ASP TNE). The OIG therefore recommends that the FBI continue to b1, b3, 
conduct additional reviews of nominations involving targeted users who have b7E 


and that the FBI document the (s) 

guiding principles for conducting these reviews. The FBI should also use these 

reviews to evaluate the issues previously raised by the OGC with regard to ie (S) 
including the appropriateness o (S) 


(S) 


С. (U//FOUO) Findings and Recommendations Relating to 
Statutory Reporting Requirements for FBI Targeting Activities 


(U//FOUO) Section 702(4(2)(С) provides that, “with respect to 
acquisitions authorized under subsection (a), [the OIG] shall review the number 
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of targets that were later determined to be located in the United States and, to 
the extent possible, whether communications of such targets were reviewed|.]” 


ДВ). The FBI is also required to conduct an annual review of the 
identical information. See Section 702(0)(3)(A)(i11). As of February 2012, when a 
draft of this report was given to the FBI for its review, the FBI had submitted 


one annual report that covered the period of September 1, 2008, through bl, b3, 
August 31, 2009 (the 2009 reporting period), effectively the first year of FBI b7E 
operations under the FAA.!! In that report the FBI stated that it “did not 

discover . . . [and] did not receive any reports from either NSA or CIA during the 


relevant reporting period indicating that the FBI had acquired subsection 
702(a)-derived of a person who was later (s) 
determined to be located in the United States at the time of the acquisition." 


However, in conducting its statutorily mandated review, the 
OIG determined that during our review period for targeting activities, (S) 


including several acquisitions where we are confident based m 
on the information available to us that the incidents met the FBI's statutory 
reporting criteria. For example, we found several instances in which the FBI 
acquired EE 000 on the same day that the NSA (5) 
determined through analysis of intercepted communications that the person 
was in the United States. We found other instances in which the NSA reviewed 
the contents of communications and similarly determined (5) 
that the targeted user was in the United States when the acquisition occurred. 
Most of these ₪ acquisitions occurred during the FBI’s 2009 
reporting period, and for that reason we believe that the FBI’s annual report 
was deficient. (S) bl, 
b3, 
b7E 
The OIG made these determinations by reviewing reports 
that the NSA is required to submit to the NSD by its targeting procedures 
whenever it acquires the communications of a person who is later determined bl, b3, 
to be in the United States or a U.S. person at the time of acquisition. We b7E 


compared these reports to FBI records of its acquisitions of пета (5) 
pU As noted, for several of these acquisitions, the NSA 

11 (U//FOUO) On May 22, 2012, the FBI transmitted two annual reports to Congress 
that covered the periods of September 1, 2009, to August 31, 2010, and September 1, 2010, to 


August 31, 2011, respectively. The OIG received copies of these documents but was unable to 
fully assess their contents prior to releasing this report. 
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information shows that the user of the targeted selector was in the United 
States on the day the uscr’s were acquired. For other 


acquisitions, the data contains a strong indication that the user was likely in E 
the United States on the day the user's communications were acquired, but the BIE 
2 


information available to the OIG was not sufficient to determine with certainty 
that each of the incidents in fact met the FBT's statutory reporting criteria. We 
believe that the FBI's expertise in analyzing presumed vc 78 (TS) 
the targeting context can be applied to determine whether a user was in the 


United States at the time an acquisition occurred, and therefore ineligible for 
coverage under Section 702. 


48//NB) In July 2011, the OIG met with senior FBI Counterterrorism 
Division, OGC, and Inspection Division officials to present our preliminary 
findings and the methodology we used to reach them. The FBI officials stated Bl 
at that time that the FBI was still exploring how to compile the requisite B3 
information for its 2010 reporting period. They also expressed concern about B7E 
being required to report on acquisitions for particular selectors that may also 


be the subject of separate reporting by the NSA, resulting in what they (S) 
characterized as NNNM 


JNE) The OIG does not believe there is any merit to this concern, 
First, the statute unambiguously requires this accounting from “the head of 
cach element of the intelligence community conducting an acquisition under 
[Section 702(a)].^ See Section 702({(3}. The FBI and the NSA both conduct 
acquisitions under Section 702, and therefore both agencies are required to 
submit these reports 


(S) 


BI 
B3 
B7E 
these distinctions, it is understandable that 
Congress would want to assess these acquisitions separately. Third, to the 
extent there are reportable acquisitions for both agencies arising from the 
conduct of electronic surveillance e for the 
same selector, that fact can be noted т the ЕВГв annual reports. 
(U//FOUO) The OIG recommends that the FBI amend ils 2009 annual 
report and ensure that it fulfills its reporting obligations under Section 
702(B(3)(A](1) without delay. 
> ВІ 
B3 
B7E 


(S) 
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b1, b3, 
b7E 


We therefore recommend that the FBI consult with the NSA about whether and 
under what circumstances the FBI should receive information developed after 


the NSA has requested a ofa selector. Ata (S) 
minimum, we believe that the FBI should request that the NSA provide it with 
copies of all reports required under (S) 


and 
that the FBI should use these reports when meeting the statutory reporting 
requirements of Section 702(1)(3)(A) (i1). 


IV. (U//FOUO) The FBI's Post-Targeting Activities Under Section 702 


The second basic activity that the FBI conducts in the 702 

(TS) 

route them in the form of raw unminimized data to 

the NSA and, at the NSA's direction, to the FBI and the CIA. The acquisition b1, b3, 
and routing of 702 data from the providers on behalf of the Intelligence 
Community is conducted b 


Program is to 


See FISA Court Memorandum Opinion, 


October 3, 2011, 


(ӘУЕ) წთ routes all the Section 702 data it acquires from the (S bl, b3, 
roviders to the NSA and at the NSA’s direction O (S) b7E 
_ On October 14, 2009, the FBI began to request that a portion of 

the raw 702-acquired data also be “dual routed” to the FBI so that it could 


retain this data for analysis and dissemination in intelligence reports. Prior to 


(TS) 
bl, 


acquisitions are referred to as “upstream collection” because they occur at NSA collection sites b3, 
located “upstream” from the domestic providers. Upstream collection is conducted without the b7E 
technical involvement of the FBI. 
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October 2009, none of the Section 702 data that the FBI acquired for the NSA 
was dual routed to and retained by the FBI. 


Section 702 data that is dual routed to the FBI is maintained in 
along with other FISA-acquired ($) 

(8d ministered by 
The FBI 1s required to acquire, retain and 
disseminate Section 702 information in accordance with its FISA Court- 
approved Standard Minimization Procedures (SMPs). 


the 
information. 


A. (U//FOUO) The FBI's Standard Minimization Procedures 


3977 EJ As required by the FISA statute, the FBI's SMPs are "specific 
procedures that are reasonably designed in light of the purpose and technique 
of the particular surveillance or physical search to minimize the acquisition 
and retention, and prohibit the dissemination, of nonpublicly available 
information concerning unconsenting United States persons consistent with 
the need of the United States to obtain, produce, and disseminate foreign 
intelligence information." See 50 U.S.C. 88 1801(h) & 1821(4). Though initially 
designed to apply to information of or concerning a United States person that 
was collected under traditional FISA, the SMPs were adapted to Section 702 
through Attorney General-approved language that conforms relevant provisions 
to Section 702. The FBI has also developed various internal guidance 
documents to explain how 702-acquired data must be handled by FBI 
personnel. 


The SMPs provide that the FBI may only acquire 702 
information in accordance with its targeting procedures, and must purge from 
its systems any communication it has acquired and retained that is 
inconsistent with the targeting and acquisition limitations set forth in Section 
702(b). 


877% The retention provisions of the SMPs restrict access to 702- 
acquired information to authorized users who have been trained on the 
requirements of the SMPs and Section 702. The SMPs provide that authorized 
users may access raw FISA-acquired information on a continuing basis only as 
necessary to determine whether it reasonably appears to be foreign intelligence 
information, to be necessary to understand foreign intelligence information or 
to assess its importance, or to be evidence of a crime (the SMP minimization 
standards). Once information has been assessed as meeting SMP minimization 
standards, it may be disseminated - that is, made more broadly available 
outside of Bm However, if the information is *of or concerning" a United (S) 
States person, the FBI's SMP Policy Implementation Guidelines (SMP 
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bl, b3, 
b7E 


TOR SECRET//SI/ /NOFORN/FISA 


Guidelines) require that the information first be сіссігопісаПу “marked В ғ (5) 
as having met SMP minimization standards before it may be disseminaled.!4 B7E 


(NE) Under the FBI’s SMP Guidelines, only case coordinators . | 
(where the 702 Team is located) are authorized to mark 702-acquired 
information in . In practice, however, the burden is on the operators in 
the field to apply SMP minimization standards to the information they wish to 
have marked. Thus, the 702 Team case coordinators defer considerably to the 
knowledge and judgment of the requesting agents and analysts concerning 
which marking to apply and why the marking 1s justified. 


B. 18ZZ-NE) FBI Retention of Section 702-Acquired Information 


(SHINE For the FBI to retain 702-acquired data for its own analysis, it 
must first request the NSA to allow the data to be “dual routed" to the FBI, The 
OIG examined the evolution of the FBI's Section 702 dual routing and retention 
policies and practices through April 2010, as well as how thc data is 
maintained in and purged from FBI systems. 


1.  (S//NF) Findings Relating to Early Dual Routing and 
Retention Issues 


SHNA The FBI did not begin to request dual routing of 702 data until 


October 14, 2009, 


із (U//FOUO) If thc information of or concerning a U.S. person does not meet the SMP 
minimization standards, the FBI must “strike or substitute a characterization” for the person's 
identity before the informalion may be disseminated. SMPs, Section Ш.С. 
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(S) bl, 
b3, 
b7E 


(S bl, 
b3, 
b7E 


) 


Ы, b3, 
b7E 


(S) 


Ы, b3, 
b6, 
b7C 
b7E 


(4) 


14 (Замер The NSA is required by its targeting procedures to conduct post-targeting 
analysis of data acquired under Section 702, whereas the FBI is not explicitly required by its 
SMPs to review the 702 data that it retains. 


15 (U//FOUO) Art Cummings, the Executive Assistant Director for the National 
Security Branch at the time of the policy change, retired from the FBI in April 2010. He 
declined the OIG’s request for an interview. 
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b1, b3, b7E 


b1, b3, 
b7E 


(57758) The OIG concluded that the careful design and implementation 
of the means by which 702 data would be housed, accessed, and tagged was 
not matched with a clear, timely, and well-considered policy from FBI executive 
managers concerning the FBI's dual routing and retention of this data. It was 
not until after the automatic dual routing request process was in place for 
several weeks that the FBI’s executive management first began to focus in b1, b3, 
earnest on whether the FBI should amass 702 counterterrorism data in (S) b7E 
rather than on a selector-specific basis. We believe these policy issues should 
have been more fully considered in advance of initiating the dual routing and 
retention process in October 2009. 


2; 4677846 Findings Relating to Access to and Purging of A 
702-Acquired Data Retained in Ри (5) 
Section 702-acquired data that Ше FBI retains Юг analysis is 
stored in Гегісі is administered Бу When the FBI first prepared to 
retain 702 data, the 702 Team worked with and the FBI OGC to make bl, 
sure that the 702 data would be labeled as 702-acquired to distinguish it from b3, 
the traditional FISA data that is also housed in (he FBI also controlled b7E 


access rights to the 702 data b 


In addition, the FBI 


Authorized users o e required to 
with each 702-acquired communication when the communication is used 
outside of such as in a disseminated intelligence report, so the data can (s) 
be traced in the event it must later be purged. 


BAER, The 702 Team is responsible for tracking 702 data that must be 
purged from FBI systems. The FBI typically learns that 702-acquired data 
must be purged when the NSA determines through post-targeting analysis that 
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the targeted communicant was in the United States or a U.S. person at the 

time of acquisition, and therefore not eligible for 702 collection. The NSA 

conveys this information to the FBI through purge reports. The 702 Team bl, b3, 
tracks the tainted data by consulting with , which maintains access logs b7E 
of each authorized user’s activity in 49) then follows up with authorized 

users who may have included the data in disseminations to ensure that the 

data has been destroyed. is responsible for purging the data from Ба (S) 

The OIG found that the 702 Team was diligent and thorough in tracking 

tainted 702 data and notifying authorized users and personnel to destroy 

it. 


с. 152598). ЕВІ Dissemination of Section 702-Acquired 
Information 


ણ The FBI defines “dissemination” to mean “providing information 
to foreign officials and entities, and federal, state, local, and tribal officials and 
entities, as well as sharing within the FBI when (or at the time) the FISA- bl, b3, 
acquired information is uploaded into a FBI system which allows for broad b7E 
access in the FBI SMP Guidelines, App. B. The FBI (S) 
provided the OIG with all disseminated intelligence reports containing 702 
information from the inception of the program through April 2010. Each 


(S) 


1. (38305 Findings Relating to Storage of Section 2 01, b3, 
Intelligence Reports in (S) b7E 


( In addition to having exclusive authority to mark 702-acquired 
data in as meeting SMP minimization standards, the 702 Team is also (S) 
responsible for maintaining disseminated intelligence reports that contain 702 
data. The 702 Team maintains these reports through an administrative case bl, b3, 
filing system in using one administrative subfile for reports containing (5) b7E 
702-acquired U.S. person information and another subfile for reports that do 
not. Each disseminated report must identify the correct subfile in the text of 
the report so that the document can be found through a text И K (S) 
auditing and oversight purposes. The OIG found that relatively few 
disseminated intelligence reports were either misfiled, mislabeled, or both, 
potentially affecting NSD’s oversight and the FBI’s reporting to Congress, both 
of which rely on accurate filing in р (S) 
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2. (U//FOUO) Findings Relating to Application of the 
Standard Minimization Procedures to Disseminated 
Intelligence Reports 


(U//FOUO) The NSD and ODNI jointly conduct reviews to assess the 
FBI's compliance with its SMPs. During our review period, these compliance 
assessments concluded that “all references to United States persons reviewed 
were consistent with the applicable minimization procedures."16 


bl, b3, 
b7E 


he OIG found that operators in the 
field generally gave careful consideration to how the information met the 
minimization standard. 


3. SPRIT Findings and Recommendations Relating to 
Treatment of 702-Acquired Metadata in Disseminated 
Intelligence Reports 


bl, b3, 
b7E 


16 However, Ше joint NSD/ODNI assessment team identified four 
disseminations that did not include the FISA warning statement (or “FISA caveat”) required by (S) 
50 U.S.C. 8 1825(c) and The warning statement advises that FISA- 
acquired information may only be used in a criminal proceeding with the advance bl. b3, b7E 
authorization of the Attorney General. COM 
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01, b3, 
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ხ1, 
ხ3, 
b7E 


bl, 
b3, 
b7E 


D. (U//FOUO) Findings and Recommendations Relating to 
Statutory Reporting Requirements for FBI Dissemination 
Activities 


(U//FOUO) Section 702(](2)(B) provides that, “with respect to 
acquisitions authorized under subsection (a), [the OIG] shall review the number 
of disseminated intelligence reports containing a reference to a United States- 
person identity and the number of United States-person identities 
subsequently disseminated by the element concerned in response to requests 
for identities that were not referred to by name or title in the original 
reportingj[.]" 


ЕЕ Ie FBI is also required to conduct an annual review that 
provides an “accounting” of the identical information. See Section 702(1)(3)(A)(1) 
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and (ii). As noted above, the FBI submitted one annual report that covered the 
period of September 1, 2008, through August 31, 2009 (the 2009 reporting 
period), Because the FBI did not begin retaining 702-acquired data until after 
the 2009 reporting period, it reported that it “did not disseminate any 
intelligence reports containing a reference to a United States-person identity 
derived from acquisitions conducted under [Section 702(a)|" during that period. 
For the same reason, the FBI also reported that it did not disseminate any U.S. 
person identities that were not referred to by name or title in original reporting. 


{SA} In conducting its statutorily mandated review, the OIG reviewed Bi 
the ! intelligence reports that the FBI disseminated between December 2009 B3 
and April 2010. These reports would fall within the FBI's annual reporting. (S) — B7E 
period for September 1, 2009, through August 31, 2010. However, as of 
February 2012, the FBI had not conducted this statutorily required annual 
review.!7? 


48,484 The OIG read its mandatory review provision broadly to include 
any reference to a U.S. person identity in a disscminated intelligence report 
that was materially related to a Section 702 acquisition ~ even if the reference 


lo the U.S. person's identity was not directly acquired undcr authority of Bl 
Section 702 B3 
B7E 


(5) 


Even though Ше communications ог 
identities of these U.S. persons were not acquired directly under Section 702, 
we believe that the references were “with respect to” 702 acquisitions within 
the meaning of the reporting provisions of Section 702. 


SNE 


(SZLNE) The FBI submitted its annual reports for September 1, 2009, through‏ זי 
August 31, 2010, and September 1, 2010, through August 31, 2011, on May 22, 2012.‏ 
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(S) b7E 


(U//FOUO} The OIG determined that the FBI did not develop a strategy 
for meeting its annual reporting requirement to provide “an accounting of the 
number of disseminated intelligence reports cantaining a reference ta a United 
States-person identity.” In fact, beyond generally acknowledging that this 
reporting requirement applies to a broader spectrum of information than the 
SMPs and minimization guidance apply to, il appeared to the OIG that FBI 
personnel gave very little thought to this important statutory obligation. 
Several witnesses, including the Operations Attorney, told the OIG that 
guidance was needed to provide direction on how to comply with the reporting 
requirements of Section 702(1(3)(А)(1 and (ii). 


ISHN The OIG recommends that the FBI OGC promptly issue 
guidance for meeting its annual reporting requirements under Section 
702()(34A)(1) and (0). In drafting this guidance, the FBI should develop а 
reasonable interpretation of that section's “with respect to” language that 
ensures that the FBI's reports to Congress fully and accurately convey the 
information Congress seeks, keeping the following principles in mind. The 
guidance should explain that that the reporting criteria extends broadly to 
disseminated intelligence reports containing a reference to a U.S. person 
identity that is “with respect to” to a Section 702 acquisition, and may 
therefore include reports in which the U.S. person is identified through a 
source other than the 702-acquired material.1* The guidance should also 
explain that a “reference to a United States-person identity” for statutory 
reporting purposes is broader than the application of the SMPs to *nonpublicly 
available information concerning unconsenting United States persons,” and 
that a reference to a U.S. person identity also may appear in metadata, such as 
in an e-mail address.!" Lastly, we believe that the FBI should create a system 


bl 
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b7E 
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for tracking intelligence reports that meet the reporting criteria as the reports 
are disseminated (ог as the FBI disseminates U.S. person identities previously 
not identified in such reports) so that its annual accountings can be issued in a 
timely manner. 


V. (U) Conclusion 


SHIA The OIG believes that in general the FBI responsibly 
implemented its Section 702 targeting procedures during our revicw 


bl 

b3 

b7E 
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(SANE) The OIG found that the FBI generally conducted its post- 
targeting activities responsibly as well, and approached its authority to retain 
and disseminate 702-acquired data with deliberation and foresight from the ba 


standpoint of ensuring compliance with the requirements and limitations of - 
Section 702. : 
Per FBI 
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ТУЫ] Lastly, we found that the FBI has not met all of its statutory 
annual reporting requirements under Section 702. As of February 2012, the 
FBI had issued one annual report that covered various Section 702 activities 
from September 2008 through August 2009. However, the OIG found that this 
report was deficient because it did not provide the number of targets whose 
stored communications were acquired and who were later determined to be in 
the United States at the time of acquisition, as required by the statute. We 
also determined that through at least February 2012, the FBI had failed to 
provide Congress with subsequent annual reports about its Section 702 
activities. In addition, we concluded that the FBI lacked the guidance 
necessary to ensure that the personnel who will be responsible for compiling 
these annual reports are able to do so with a consistent understanding of the 
reporting requirements of Section 702. We recommend that the FBI promptly 
correct deficiencies in its first annual report, and that FBI OGC issue guidance 
necessary for meeting its annual reporting requirements in a timely manner. 


(U//FOUO) Based on our findings, we made seven recommendations 
designed to improve the FBI’s conduct of its activities under Section 702. The 
FBI and the National Security Division have provided comments to these 
recommendations, which are appended to this report. The OIG intends to 
closely monitor the FBI’s progress in implementing these recommendations. 
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(U) CHAPTER ONE 
INTRODUCTION 


(U//FOUO) The Foreign Intelligence Surveillance Act of 1978 
Amendments Act of 2008 (FAA) was signed into law on July 10, 2008. The FAA 
was enacted as part of Congress’s effort to modernize the Foreign Intelligence 
Surveillance Act of 1978 (FISA), codified at 50 U.S.C. §§ 1801-1885. 


The FAA followed earlier efforts to enhance the nation’s 
ability to gather signals intelligence in the wake of the terrorist attacks of 
September 11, 2001. In October 2001, the President authorized a highly ' 
classified program, known as the President’s Surveillance Program, to conduct 
electronic surveillance of certain communications into and out of the United 
States without seeking orders from the Foreign Intelligence Surveillance Court 
(FISA Court).2° This program was transitioned in stages to FISA Court 
supervision beginning in 2004. 


F) However, according to a former senior Justice Department 
official familiar with these events, in May 2007, the FISA Court imposed 
rigorous procedural requirements on the government’s foreign surveillance 
authority, causing the National Security Agency (NSA) to place fewer foreign 
selectors under coverage than it wanted to.?! To address concerns that the 
Intelligence Community was unable to swiftly collect critical foreign 
intelligence, Congress thereafter enacted two major amendments to the original 
FISA statute. The first of these amendments was the Protect America Act of 
2007 (PAA), a temporary legislative measure that expired on February 16, 
2008. It was followed by the FAA, key provisions of which are set to expire on 
December 31, 2012. 


(U//FOUO) The FAA authorizes the collection of foreign intelligence 
information from persons reasonably believed to be located outside of the 
United States. This portion of the FAA contains separate sections authorizing 
such collection under three different circumstances: targeting non-U.S. 
persons outside the United States (Section 702); acquisitions inside the United 
States targeting U.S. persons outside the United States (Section 703); and 
other acquisitions targeting U.S. persons outside the United States (Section 
704). 


20 (U//FOUO) The FISA Court was established under the FISA statute to review the 
government’s applications to exercise FISA authority and grant orders approving such 
applications. 50 U.S.C. § 1803. 


21 אלל‎ А “selector” is either a telephone number or an identifier used for Internet 
communications, such as an e-mail account. 
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(U//FOUO) Section 702, which is the focus of this report, allows the 
Attorney General and the Director of National Intelligence to jointly authorize, 
for up to 1 year, the targeting of non-U.S. persons reasonably believed to be 
located outside the United States. To exercise this authority, the Attorney 
General and the Director of National Intelligence must adopt targeting and 
minimization procedures that govern how targets are determined to be non- 
U.S. persons outside the United States and how the information acquired may 
be retained and disseminated. The statute places limitations on the 
government's targeting authority by prohibiting thc intentional targeting of 
persons known to be in the United States at the time of acquisition, and the 
targeting of persons outside the United States where the purpose of the 
acquisition is to obtain the communications of *a particular, known person 
reasonably believed to be in the United States" (a practice known as “reverse 
targeting”). The targeting and minimization procedures adopted by the 
Attorney General and the Director of National Intelligence are subject to FISA 
Court review and approval. 


+ Section 702 also requires the government to certify that “the 
acquisition involves obtaining foreign intelligence information from or with the 
assistance of an electronic communication service provider." Under Section 
702, foreign intelligence is obtained from these U.S.-based electronic 
communications service providers (U.S. providers) either by conducting 
electronic surveillance of communications as they are transmitted, or by 
conducting a search of communications that are in electronic storage after they 
have been transmitted. 


¿S/¿NE) The Federal Bureau of Investigation (FBI) and the National 
Security Agency (NSA) are the only agencies authorized to acquire foreign Bl 
intelligence information under Section 702. The NSA is the lead agency in the pa 
702 Program and, during the OIG's review period, was the only agency with the — pp 
formal authority to initiate electronic surveillance 
under FISA Court-approved targeting procedures. Thus, 


during our review period, the NSA initiated all such electronic surveillance ES 
Ес although sometimes the NSA did so on behalf 
of the Central Intelligence Agency (CIA), or at the request of the FBI. 


Bl 
B3 
875 


ТОР SECRET7TSTTTNOFORN/FISA- 


The FBI then a 
Court-approved targeting procedures to determine whether 


lies its FISA (5) bl, ხვ, 


(S 
the NSA’s 5 b7E 


determination that the presumed user of the account is a non-U.S. person 
located outside the United States. 


SPINE, The FBI is also responsible for routing to the NSA all 
communications acquired from providers under Section 702, 


(S) 

The 702- bl, 
acquired information may be routed to the CIA or the FBI as well, but only b3, 
upon request and subject to the approval of the NSA. b7E 


The FBI retains this information for analysis and 
dissemination in connection with its national security investigations. 


(U//FOUO) This report describes the Office of the Inspector General’s 
(OIG) review of the FBI’s use of the authorities provided in Section 702 of the 
FAA. Section 702(0(2)(А) authorizes the OIG to review the FBI's compliance 
with its targeting and minimization procedures. The OIG also conducted this 
review pursuant to its authority under the Inspector General Act of 1978, as 
amended, codified at 5 U.S.C. App. 3. 


(U//FOUO) The FBI’s compliance with its targeting and minimization 
procedures is subject to mandatory reviews that are conducted jointly by the 
Department of Justice (DOJ) and the Office of the Director of National 
Intelligence (ODNI). The OIG sought to avoid replicating the DOJ and ODNI’s 
compliance reviews, and instead concentrated on assessing the policies and 
procedures that the FBI implemented to carry out its targeting and post- 
targeting activities. 


(U//FOUO) This report also discusses the OIG’s findings with respect to 
three reviews we are required to conduct under Section 702)()2()2( and (С) 
concerning the FBI’s acquisition and dissemination of U.S. person information. 
Specifically, with respect to acquisitions authorized under Section 702(a), the 
OIG is required to review: 


bl, 
22 SR, After reviewing a draft of this report, the NSA objected to this 


characterization of the FBI’s to the extent it suggests that the NSA lacks ДД ($) 55; 
pursuant to Section 702. (S) b7E 
3 
TO FISA 


TOP 


e (U//FOUO) “the number of targets that were later determined to 
be located in the United States, and to the extent possible, whether 
communications of such targets were reviewed”; 


e (U//FOUO) “the number of disseminated intelligence reports 
containing a reference to a United States-person identity”; and 


e (U//FOUO) “the number of United States-person identities 
subsequently disseminated . . . in response to requests for 
identities that were not referred to by name or title in the original 
reporting[.]” 


(U//FOUO) The FBI is also required by Section 702(1(3) to provide annual 
reports concerning this same U.S. person information. 
I. (U//FOUO) Methodology of OIG Review 


ASPIRE) During the course of this review, the OIG interviewed 
approximately 45 individuals, including FBI personnel who administer the 702 Ы, b3, 


Program (referred to in this report as the 702 Team), senior FBI b7E 
Counterterrorism Division officials, personnel in the FBI’s (S) 
d the who help 


support 702 ב‎ former FBI General Counsel Valerie Caproni, and 
other Office of General Counsel attorneys who provided legal advice to the FBI 
concerning Section 702 during our review регіоа.23 In addition, we interviewed 
several National Security Division attorneys, National Security Agency officials, 
and officials in the Office of the Director of National Intelligence. 


SH We also reviewed thousands of documents, including b1, b3, 
approximatel individual files documenting the FBI's processing of NSA (5) зр 
requests , approximate (5) 
disseminated intelligence reports, FISA Court filings, Office of Legal Counsel 
memoranda, FBI guidance documents and training materials, National Security 
Division compliance reports, and e-mails among FBI and other officials 
discussing the 702 Program. 


bl, 


EIN addition to conducting interviews and examining documents, b3, 
the OIG conducted various statistical analyses of the CP (S) 975 


using random sampling and other analytic 


techniques. 


23 (U//FOUO) Art Cummings, the Executive Assistant Director for the FBI's National 
Security Branch until his retirement from the FBI in April 2010, declined the OIG’s request for 
an interview. 
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II. (U) Organization of this Report 


(U//FOUO) In Chapter Two of this report we briefly describe how certain 
intelligence-gathering activities first authorized by the President in 2001 were 
brought under FISA Court supervision, followed by Congress's effort to 
modernize the FISA statute through the Protect America Act of 2007 and the 
FISA Amendments Act of 2008. We also discuss the legal provisions of Section 
702, and provide an overview of the FBI offices and personnel who administer 
the 702 Program for the FBI. 


(TSFPStH NR, In Chapter Three we describe the FBI’s targeting activities 
with respect to NSA nomination dig i The (TS) 


OIG’s review period for these targeting activities is from September 2008, EN (TS) b1, b3, 


review the special procedures that the FBI developed fo 
involving persons who had (TS) 


Lastly, we provide our review of the number at (TS) 
were acquired when the presumed user of the targeted account was later 
determined to be in the United States at the time of acquisition, as required by 
Section 702(0(2)(С). 


Әрнү In Chapter Four we describe the FBI’s post-targeting activities, 
which involve the acquisition, routing, retention, purging, minimization, and 
dissemination of 702-acquired information. The OIG's review period for these 
activities extends through April 2010. However, because the FBI did not begin 
to retain 702 data until October 2009, we were only able to examine 
approximately seven months of information related to these post-targeting 
activities. We describe the policies and practices surrounding the FBI’s 
eventual participation in the routing and retention process as a recipient of 
702-acquired data, and how those policies and practices changed over time. 
We also describe the role of the 702 Team and other FBI personnel in the 
acquisition, retention, and dissemination process, and assess the FBI’s 
application of its Standard Minimization Procedures and relevant guidance to 
disseminated intelligence reports containing 702 information. Lastly, we 
provide our review of the number of disseminated intelligence reports 
containing a reference to a U.S. person identity, as required under Section 
702()(2)(B). 
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(U//FOUO) In Chapter Five we provide our conclusions and 
recommendations. Based on our findings, we made seven recommendations 
designed to improve the FBI's conduct of its activities under Section 702. The 
FBI and the National Security Division have provided comments to these 
recommendations, which are appended to this report. The OIG intends to 
closely monitor the FBI's progress in implementing these recommendations. 
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(U) CHAPTER TWO 
BACKGROUND 


(U//FOUO) In this chapter, we describe the transition of certain foreign 
intelligence-gathering activities from presidential authority under what was 
known as the "Terrorist Surveillance Program," which was in operation from 
2001 through early 2007, to activities approved and supervised by the FISA 
Court during 2007. We then describe how efforts to modernize the Foreign 
Intelligence Surveillance Act of 1978 (FISA) through legislation and continued 
FISA Court supervision of these activities led to the enactment of the Protect 
America Act of 2007 (PAA), and later the FISA Amendments Act of 2008 (FAA). 


(U//FOUO) We also provide an overview of Section 702 of the FAA, 
which authorizes the government to target non-U.S. persons reasonably 
believed to be located outside the United States to acquire foreign intelligence 
information, subject to certain limitations and in accordance with FISA Court- 
approved targeting and minimization procedures. Finally, we provide an 
overview of the FBI offices and personnel who administer the 702 Program for 
the FBI, as well as a brief description of how the FBI has used Section 702 in 
the past, and how it intends to use the statute in the future. 


b7E 
I. Transition of 


A. (U//FOUO) The Terrorist Surveillance Program 


(U//FOUO) Following the terrorist attacks of September 11, 2001, the 
President authorized the National Security Agency (NSA) to use its signals 
intelligence capabilities to detect and prevent further attacks against the 
United States. The classified activities that the President authorized and the 
information derived from them fell into distinct categories that collectively came 
to be known as the “President's Surveillance Program" (PSP).2* One category of 
activity under the PSP was publicly confirmed by the President in December 
2005 following a series of media reports about the NSA's surveillance 
program.?5 That activity, called the "Terrorist Surveillance Program" or "TSP," 


2* (U//FOUO) A detailed description of this program may be found in a classified OIG 
report entitled, *A Review of the Department of Justice's Involvement with the President's 
Surveillance Program" (July 2009). 


25 (U//FOUO) The first media account of the NSA surveillance activities appeared in a 
series of articles published in The New York Times between December 16 through 19, 2005. 
See *Bush Lets U.S. Spy on Callers Without Courts," James Risen and Eric Lichtblau, New 
York Times, December 16, 2005. 
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authorized the NSA, 
to intercept the content of 
communications into and out of the United States where there was a 
reasonable basis to conclude that at least one of the communicants was a 
member of al Qaeda, affiliated with a! Qaeda, or a member of an organization 
affiliated with al Qaeda. 


#FS//SHH/ NE) The TSP and the other intelligence activities authorized by 
the President under the PSP were legally controversial because these activities 
traditionally were viewed to bc governed by the FISA statute.26 Subject to 
certain statutory exceptions, and until it was amended in 2007 by the PAA, 
FISA generally required the approval of the FISA Court whenever the 
government sought to acquire, for foreign intelligence purposes, “the contents 
of any wire communication to or from a person in the United States, without 
the consent of any party thereto, if such acquisition occurs in the United 
States." For the FISA Court to grant authority to conduct electronic 
surveillance, the government would first have to establish probable causc to 
believe that the target of the survcillance is a “foreign power” or an “agent of a 
foreign power," and that "each of the facilities or places at which the electronic 
surveillance is directed is being used, or is about to be used" by the target. 
FISA imposed similar legal requirements to conduct a physical search, 
including of stored electronic communications. 


(U//FOUO) When FISA was enacted in 1978, most international 
telephone calls were carried by satellite. Under FISA, the interception of such 
calls constituted “electronic surveillance" only if the acquisition intentionally 
targeted a U.S. person in the United States, or if al) participants to the 
communication were located in the United States. Thus, government 
surveillance of satellite communications that targeted foreign persons outside 
the United States generally was not considered electronic surveillance, and the 
government was not required to obtain a FISA Court order authorizing thc 
surveillance, even if one of the parties to the communication was in the United 
States. 


S/S) In the mid-1980s, however, fiber optic technology began to 
replace satellites as thc primary means for transmitting international (and 
domestic) communications. Because many of these communications were now 
*wire communications" routed through and acquired inside the United States, 


ж (U//FOUO) Proponents of this view cite 18 U.S.C. 8 251 ЦОН, which states, in 
relevant part. that the 


(U) procedures in [chapter 119 and 11 of title18] and the Foreign Intelligence 
Surveillance Act of 1978 shall be the exclusive means by which electronic 
surveillance, as defined in section 101 of such Act, and the interception of 
domestic wirc, oral, and electronic communications may be conducted. 
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this change in technology brought most electronic communications within 
FISA’s definition of “electronic surveillance.” Consequently, the government 
was required to obtain FISA Court orders to conduct electronic surveillance it 
previously had been authorized to conduct outside of FISA. 


(U//FOUO) Under the TSP, the President authorized electronic 
surveillance to be conducted without the particularized probable cause 
_ showings to the FISA Court required under FISA. According to a Justice 
Department memorandum publicly released on January 19, 2006, the TSP was 
“supported by the President’s well-recognized inherent constitutional authority 
as Commander in Chief and sole organ for the Nation in foreign affairs to 
conduct warrantless surveillance of enemy forces for intelligence purposes to 
detect and disrupt armed attacks on the United States.” The Department 
further maintained that the program was lawful because, in the wake of the 
September 11 terrorist attacks, Congress had passed an Authorization for the 
Use of Military Force, which “confirms and supplements” the President’s 
inherent power to conduct warrantless surveillance during wartime. 


B. (U//FOUO) FISA Court Orders 


PESTE) Beginning in 2004, the PSP activities authorized by the 
President were transitioned in stages to FISA authority under a series of orders 
issued by the FISA Court. The last of the activities to come under FISA Court 
order was the TSP. The transition of the TSP from presidential authority to 
FISA Court orders was precipitated in part by the disclosure of the program in 
a series of articles in The New York Times in December 2005. 


20377955348). The government's application to the FISA Court for this 
electronic surveillance authority was premised on a novel and expansive 
interpretation of the FISA statute. As noted, FISA generally required the 
government to establish probable cause to believe that the target of the 
surveillance is a “foreign power” or an “agent of a foreign power,” and that 
“each of the facilities or places at which the electronic surveillance is directed is 
being used, or is about to be used” by the target. In its post-TSP filings with 
the FISA Court, the government proposed that the term “facilities” be 
interpreted far more broadly than how the term ordinarily had been applied.27 
The government also requested that senior NSA officials, rather than a FISA 
Court judge, be authorized to make individualized findings of probable cause to 


bl, b3, 
b7E 


determine that a particular telephone number or e-mail address was bein 
used by a member or agent of the targeted — ОИ (TS) 


27 nder the FISA statute, the term “facilities” generally was understood 
to apply to specific telephone numbers or e-mail addresses (collectively referred to as 


“selectors”). 
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and that the communication was to or (TS) 
from a foreign country. 


XT577S:7/NE) FISA Court Judge Malcolm Howard granted the 
government’s application as to foreign selectors on January 10, 2007.28 On 
January 17, 2007, Attorney General Alberto Gonzales wrote to Senators Patrick 
Leahy and Arlen Specter, respectively the Chairman and Ranking Minority 
Member of the Senate Judiciary Committee, to inform them that due to Judge 
Howard’s order approving the government’s application, collection under the 
TSP would cease. | 


ТУРНЕ} On March 20, 2007, the government filed an application 
to renew Judge Howard's January 10 Order. The renewal application was filed 
with Judge Roger Vinson, the FISA Court *duty judge" during that week. In an 
April 3, 2007 Memorandum and Order, Judge Vinson wrote that he could not 
grant the government's renewal application. He determined, based on past 
practice under FISA and the Congressional intent underlying the statute, that 
the FISA Court, not senior NSA officials, must make the necessary probable 
cause determinations. He also rejected the government's broad construction of 
the term "facilities," concluding that the electronic surveillance to be conducted 


by the government was directed at specific telephone numbers and e-mail 
N —Ó— as 


While sympathetic to the government's stated need for 
enhanced “speed and flexibility" in responding to terrorist threats, Judge 
Vinson concluded that FISA's requirements reflected a balance struck by 
Congress between privacy interests and the need to obtain foreign intelligence 
information, and until Congress took legislative action on FISA to respond to 
the government's concerns, the FISA Court was bound to apply FISA's 
procedures. In denying the government's application, Judge Vinson urged the 
government to seek a 60-day extension of Judge Howard's foreign selectors 
order, which the government subsequently sought and obtained. 


ISHA The government later submitted a revised renewal 
application and, on May 31, 2007, obtained authority from Judge Vinson to 
conduct electronic surveillance on foreign selectors. This authority, however, 
was considerably narrower than the authority initially sought from and granted 
by Judge Howard. Although the government was allowed to conduct electronic 
surveillance targeting selectors reasonably believed to be used outside the 
United States and for which probable cause existed to believe were being used 


28 સડક Judge Howard declined to authorize 8 of (TS) 
selectors used by persons in the United States (domestic selectors) in the manner proposed by 


the government in its application. 


poro 10 3 


b1, b3, 
b7E 


bl, 
b3, 
b7E 


bl, b3, 
b7E 


bl, b3, 
or about to be used by (15) 7E 


associated terrorist entities, the FISA Court - and not the NSA - would make 
the probable cause determinations as to each selector. 


ગક Under the May 31, 2007 Order, the FISA Court initially 
approved approximately | foreign selectors for which the NSA previously (TS) 
had found probable cause to conduct electronic surveillance under the terms of 
the earlier FISA Court Order. However, according to a former senior Justice 
Department official familiar with these events, the rigorous nature of the FISA Ы, b3, 
Court’s probable cause review of new selectors submitted to the various FISA b7E 
Court judges following Judge Vinson’s May 31, 2007 Order caused the NSA to 
place fewer foreign selectors under coverage than it wanted to. This factor and 
the comparatively laborious process for targeting foreign selectors under Judge 
Vinson’s Order combined to accelerate the government’s efforts to amend the 
FISA statute to streamline and modernize the government’s surveillance 
authorities within the United States directed at persons located outside the 
United States. | 


(5702315940) The PAA, and its successor, the FAA, accomplished many 
of these objectives. The PAA, described briefly below, was signed into law on 
August 5, 2007. Because the PAA effectively superseded Judge Vinson’s May 
31, 2007, foreign selectors Order, the government did not seek to renew the 
Order when it expired on August 24, 2007. 


С. (U//FOUO) The Protect America Act 


(U//FOUO) The Protect America Act of 2007 (PAA), Pub. L. No. 110-55, 
was enacted as a temporary measure to address the legal impediments that 
existed under FISA to the swift acquisition within the United States of 
communications to or from targeted foreign selectors.2? The PAA accomplished 
this by amending FISA to exclude from the statute’s definition of “electronic 
surveillance” the interception of communications to or from targeted foreign 
selectors. 


(U//FOUO) Under the FISA statute’s original definition of “electronic 
surveillance,” FISA Court authorization generally was required to intercept any 
communication to or from a “particular, known United States person who is in 
the United States” if the communication was acquired by targeting that person. 
Such authorization also was necessary to acquire other communications (such 
as those acquired by targeting persons outside the United States) if the 


29 (U//FOUO) The PAA was signed into law on August 5, 2007. It was set to expire 
180 days after its enactment, or on February 1, 2008. However, Congress passed a bill, signed 
by the President on January 31, 2008, extending the PAA for 15 days so that discussions on 
new legislation could continue. No agreement on new legislation was reached during that 
period, and the PAA expired on February 16, 2008. 
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communication was a “wire communication to or from a person in the United 
States” and the acquisition occurred inside the United States. 


(U//FOUO) The PAA amended FISA by providing: “Nothing in the 
definition of electronic surveillance . . . shall be construed to encompass 
surveillance directed at a person reasonably believed to be located outside the 
United States.” The effect of this amendment was to exclude from the 
individualized FISA Court application and order requirements of FISA any 
communication acquired by targeting a person overseas, regardless of where 
the communication was intercepted, whether the communication traveled by a 
wire, or whether the target was a known United States person determined by 
the Attorney General to be an agent of a foreign power located outside the 
United States. 


(U//FOUO) In place of these individualized FISA Court applications and 
orders, the PAA inserted a new legal mechanism to govern the acquisition of 
communications from persons “reasonably believed to be located outside the 
United States.” The PAA provided that the Attorney General and the Director of 
National Intelligence may authorize the acquisition of foreign intelligence 
information concerning such persons for up to one year, provided these 
officials certified that there were reasonable procedures in place for the 
government to determine that a target was reasonably believed to be outside 
the United States and that the acquisition of the foreign intelligence therefore 
was not “electronic surveillance” under the amended definition of the term. 
Unlike traditional FISA, the PAA did not require the Attorney General and the 
Director of National Intelligence to identify the specific facilities or places at 
which the acquisition of foreign intelligence information was directed. 


(U//FOUO) In order to authorize such acquisition of foreign intelligence 
information, the Attorney General and the Director of National Intelligence also 
were required to certify that the minimization procedures to be used with 
respect to such acquisitions comported with the procedures adopted by the 
Attorney General for minimizing information obtained by electronic surveillance 
under FISA.30 As discussed in Chapters Three and Four, these targeting and 
minimization requirements are central features of the intelligence-gathering 
and sharing activities conducted under Section 702 of the FISA Amendments 
Act as well. 


30 (U//FOUO) FISA generally requires that with respect to electronic surveillance the 
Attorney General shall adopt “specific procedures... . that are reasonably designed in light of 
the purpose and technique of the particular surveillance, to minimize the acquisition and 
retention, and prohibit the dissemination, of nonpublicly available information concerning 
unconsenting United States persons consistent with the need of the United States to obtain, 
produce, and disseminate foreign intelligence information[.]’ 50 U.S.C. 8 1801(h). 
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(U//FOUO) In addition to addressing targeting and minimization 
requirements in the certification, the Attorney General and the Director of 
National Intelligence also were required to certify that the acquisition involved 
obtaining the foreign intelligence information from or with the assistance of a 
communications service provider having access to the communications, either 
as the communications were transmitted or while they were stored, and thata 
“significant purpose of ihe acquisition is to obtain foreign intelligence 
information|. |? 


(U//FOUO) The PAA left unchanged the procedures for acquiring foreign 
intelligence information by targeting foreign powers or agents of foreign powers 
in the United States, as well as the procedures under Executive Order 12,333 
(E.O. 12,333) Section 2.5, to obtain Attorney Gencral approval before acquiring 
foreign intelligence information against a U.S. person outside the United 
States. 


4SZZNE) The first PAA certification was filed with the FISA Court on 


August 9, 2007. ણણ ^ 
were filed with the FISA Court under the PAA. The FISA Court reviewed these 


certifications and approved them, allowing the government to continue the 
activities authorized by the Attorney Gencral and the Director of National 
Intelligence to acquire foreign intelligence information concerning persons 
reasonably believed to be outside the United States without individualized FISA 
Court approval for up to one ycar. These acquisitions were conducted by the 


NSA. As of January 31, 2008, the PAA certifications also authorized the FBI to 
acquire הוואש‎ = behalf of the NSA. After the PAA expired on 
February 16, 2008, the government’s foreign intelligence acquisition authority 


under the statute gradually lapsed as the individual certifications expired. The 
final PAA certification expired in April 2009. 


The respective roles of the NSA, the CIA, and the FBI under the PAA 
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were formalized in a Memorandum of Understanding (MOU) signed in April 
2008.*! 


45-25-48) The ЕВГ role under the PAA thus became virtually 
identical to 15 current role under the Section 702 of the FAA - to acquire, on Bl 


behalf of the NSA (and the CLA through the NSA) მ ვდ. B3 
persons reasonably believed to be located outside the B7E 


United States, and to provide technical assistance to the NSA in acquiring the 
in-transit communications of persons reasonably believed to be outside the (5) 
United States. 


(U//FOUO) Although the Department viewed the PAA аз an adequate 
temporary fix to those provisions of FISA seen as outdated because of changes 
in telecommunications technology, Department and other Intelligence 
Community officials continued to press Congress for more permanent 
modernization legislation. The result of these efforts was the FISA 
Amendments Act of 2008. 


П. (U) The FISA Amendments Act of 2008 


(U//FOUO) The FISA Amendments Act of 2008 (FAA) was signed into 
law as Public Law 110-261 on July 10, 2008. According to the FAA’s legislative 
history, Congress had two primary goals in passing the FAA. First, Congress 
wanted to provide a sound statulory framework, consistent with the 
Constitution, enabling the targeting of persons reasonably believed to be 
located outside of the United States for the acquisitions of foreign intelligence 
information, while simultaneously affording additional protections to United 
Stales persons whose communications are targeted for collection or collected 
incidentally. In striking this balance, Congress discarded the PAA’s 
redefinition of the term “electronic surveillance,” which had excluded from 
FISA’s individualized order requirement ail persons outside the United States, 
including U.S. persons, and instead promulgated a specific authorization for 
the acquisition of communications from non-U.S. persons located outside the 
United States without an individualized order. The result was a sharply 
narrowed statute under which U.S. persons overseas could no longer be 


ડા 54%) According lo an attorney in the FBI's Office of General Counsel who 
participated in drafting the Memorandum of Understanding (MOU), the document took a long 
time to negotiate, and was not finalized until after the PAA expired. However, the attorney 
stated that the MOU remained in effect after the PAA expired because certifications issued 
under the PAA were valid for one year, and thus the use of PAA authority extended beyond the 
PAA’s expiration. This attorney also staled that the MOU remains in effect under the PAA to 
the extent it is relevant to the FAA's provisions. Thus, provisions in the MOU concerning 
targeting the accounts of U.S. persons, which is prohibited under the FAA, are considered void. 
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targeted without an individualized warrant, as had been possible prior to the 
FAA. 


(U//FOUO) Second, Congress wanted to provide civil immunity for those 
electronic communication service providers who had provided assistance to the 
Intelligence Community under the PSP pursuant to written assurances that the 
program had been authorized by the President and determined to be lawful. 
See, e.g., Foreign Intelligence Surveillance Act of 1978 Amendments Act of 
2007, S. Rep. No. 110-209 (Oct. 26, 2007). 


(U//FOUO) Consistent with these two goals, the FAA contains two 
primary provisions: an authorization to collect foreign intelligence information 
by targeting non-U.S. persons located overseas, including explicit limitations 
on that authority and an oversight regime to monitor its use; and a mechanism 
to extend immunity to qualifying electronic communication service providers 
for prior participation in the PSP. 


A. (U//FOUO) The Authorization to Collect Foreign Intelligence 
Information 


(U//FOUO) The FAA authorizes the collection of foreign intelligence 
information from persons reasonably believed to be located outside of the 
United States. The Act contains separate sections authorizing such collection 
under three different circumstances: targeting non-U.S. persons outside the 
United States (Section 702); acquisitions inside the United States targeting U.S. 
persons outside the United States (Section 703); and other acquisitions 
targeting U.S. persons outside the United States (Section 704).32 These 
provisions, and in particular Section 702, which is the focus of this review, are 
summarized below. 


1. (U//FOUO) Section 702 
a. (U//FOUO) Authorization and Limitations 


(U//FOUO) Section 702, which is codified at 50 U.S.C. 8 1881a, et seq., 
authorizes the targeting of non-United States persons who are reasonably 
believed to be located outside of the United States to acquire foreign 
intelligence information, without an individualized order from the FISA Court.33 
The affirmative authorization contained in Section 702(a) states: 


32 (U//FOUO) These provisions will expire on December 31, 2012, unless reauthorized 
by Congress. See FAA, Section 403(b)(1). 


33 (U//FOUO) Section 701(a) incorporates the definition of “United States person” 
provided in Title I of FISA: 


(Cont'd.) 
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(U) (a) AUTHORIZATION.—Notwithstanding any other provision of 
law, upon the issuance of an order in accordance with subsection 
[FAA] (1(3) or a determination under [FAA] subsection (c)(2), the 
Attorney General and the Director of National Intelligence may 
authorize jointly, for a period of up to 1 year from the effective date 
of the authorization, the targeting of persons reasonably believed to 
be located outside the United States to acquire foreign intelligence 
information. 


(U//FOUO) The affirmative authorization contained in Section 702(a) is 
strictly limited in several ways. Under the terms of subsection (a) itself, any 
acquisition under Section 702(a) must be made pursuant to either a FISA 
Court order (through the approval of a “certification,” discussed below), or a 
determination that exigent circumstances exist, as defined in Section 702(c)(2) 
and subject to subsequent and expeditious action by the FISA Court.3^ The 
plain language of subsection (a) also requires that acquisitions pursuant to 
Section 702(a) must be conducted “to acquire foreign intelligence information,” 
and that the person targeted for such acquisition be reasonably believed to be 
located outside the United States. Id. 


(U//FOUO) Section 702(b) specifies limitations to the authority to collect 
foreign intelligence information under subsection (a).35 The chief limitation 


(U) “United States person” means a citizen of the United States, an alien 
lawfully admitted for permanent residence . . . , an unincorporated association a 
substantial number of members of which are citizens of the United States or 
aliens lawfully admitted for permanent residence, or a corporation which is 
incorporated in the United States, but does not include a corporation or an 
association which is a foreign power, as defined in subsection (a)(1), (2), or (3) of 
this section. 


(U) 50 U.S.C. 8 18014. 


34 (U//FOUO) Section 702(c)(2) allows for the Attorney General and the Director of 
National Intelligence to determine that exigent circumstances exist when, “without immediate 
implementation of an authorization under subsection (a), intelligence important to the national 
security of the United States may be lost or not timely acquired and time does not permit the 
issuance of an order” from Ше FISA Court. See FAA $ 702(c)(2), 50 U.S.C. 8 1881a(c)(2). When 
such a determination is made, however, the Attorney General and the Director of National 
Intelligence must submit to the FISA Court a certification for such authorization “as soon as 
practicable but in no event later than 7 days after such determination is made.” FAA 
S 702(g)(1)(B), 50 U.S.C. 8 1881a(g)(1)(B). 


35 (U) The full text of Section 702(b) states: 
(U) (b) Limitations.—An acquisition authorized under subsection (a)— 


(U) (1) may not intentionally target any person known at the time of 
acquisition to be located in the United States; 


(Cont'd.) 
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imposed by Section 702(b) is that the acquisition may not intentionally target a 
United States person; as discussed below, the targeting of United States 
persons under the FAA is addressed in Sections 703 and 704. Section 702(b) 
also specifically prohibits the intentional targeting of any person “known at the 
time of acquisition to be located in the United States.” Together, these two 
limitations — that the acquisition target non-United States persons reasonably 
believed to be located outside the United States at the time of acquisition — 
form what the Intelligence Community commonly refers to as the “foreignness” 
requirement. The foreignness requirement is designed to ensure that all 
persons located in the United States, and United States persons located 
anywhere, are afforded the protections of the more robust procedural 
requirements for acquisitions under other sections of the FAA and FISA. 


(U//FOUO) Section 702(b) imposes other limitations and prohibitions 
designed to ensure that subsection (a) is not used for surveillance directed at 
persons within the United States, or at United States persons. Specifically, 
acquisitions authorized under subsection (a) may not intentionally target a 
person reasonably believed to be located outside the United States “if the 
purpose of the acquisition is to target a particular, known person reasonably 
believed to be in the United States” — the prohibited practice commonly referred 
to as “reverse targeting.” Nor may Section 702(a) be used to intentionally 
acquire a communication if the sender and all intended recipients are known at 
the time of acquisition to be in the United States. Finally, Section 702(b) 
explicitly mandates that acquisitions made pursuant to Section 702(a) must be 
conducted in a manner consistent with the Fourth Amendment to the United 
States Constitution, which provides for “Це right of the people to be secure in 
their persons, houses, papers, and effects, against unreasonable searches and 
seizures.” 


(0) (2) may not intentionally target a person reasonably believed to be 
located outside the United States if the purpose of such acquisition is to target a 
particular, known person reasonably believed to be in the United States; 


(0) (3) may not intentionally target a United States person reasonably 
believed to be located outside the United States; 


(U) (4) may not intentionally acquire any communication as to which the 
sender and all intended recipients are known at the time of the acquisition to be 
located in the United States; and 


(U) (5) shall be conducted in a manner consistent with the fourth 
amendment to the Constitution of the United States. 
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b. (U//FOUO) Procedural Requirements of Section 
702 


(U//FOUO) Section 702(c) requires that acquisitions authorized 
pursuant 10 Section 702(a) shall conform to “the targeting and minimization 
procedures adopted in accordance with subsections (d) and (e),” and “upon 
submission of a certification in accordance with subsection (g), such 
certification,” as explained below. FAA, Section 702(c)(1). 


(U//FOUO} Section 702(d) requires the Attorney General, in 
consultation with the Director of National Intelligence, to adopt targeting 
procedures that are reasonably designed to ensure that the acquisition of 
foreign intelligence information pursuant to Section 702 complies with the 
limitations in subsections (a) and (b). Specificalty, Section 702(d)(1)(A) requires 
that the procedures “ensure that any acquisition authorized under subsection 
(а) is limited to targeting persons reasonably believed to be located outside the 
United States,” and Section 702{d}(2)(B) requires that the procedures “prevent 
the intentional acquisition of any communication as to which the sender and 
all intended recipients are known at the time of the acquisition to be located in 
the United States." These targeting procedures are subject to judicial review." 


WA Foo Section 702(e) requires the Attorney General, again in 
consultation with the Director of National Intelligence, to adopt minimization 
procedures governing the retention and dissemination of information acquired 
under Section 702(a) that meet the statutory rules in FISA that are otherwise 
applicable to data acquired through electronic surveillance and physical 
scarches. Those provisions of FISA provide that the minimization procedures 
must be designed to “minimize the acquisition and retention, and prohibit the 
dissemination, of nonpublicly available information concerning unconsenting 
United States persons consistent with the need of thc United States to obtain, 
produce, and disseminate foreign intelligence information.” The minimization 
procedures adopted under the FAA are subject to judicial review.** 


(U//FOUO) In addition to specific targeting and minimization 
procedures, Section 702(f) requires the Attorney General, in consultation with 


36 {SA/NE) At present, only the NSA and the FBI conduct acquisitions under Section 
702, and thus are required tu submil their Largeting procedures to the FISA Court for review. В] 


The CIA nominates selectors for electronic surveillance to the UO s B3 
through the NSA to the FBI, and therefore does not submit 


targeting procedures ta the FISA Court. The NSA's and FBI’s targeting procedures are B7E 
discussed in Chapter Three. 

37 (ВААЧЕ) The CIA, NSA, and ЕБІ each receives raw Section 702-acquired data and is 
required to retain and disseminate such data in accordance with its own minimization 
procedures. Therefore, the FISA Court must review the minimization procedures of all three 
agencies. The FBI's minimization procedures are discussed in Chapter Four. 
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the Director of National Intelligence, to adopt guidelines to ensure “compliance 
with the limitations in subsection (b),” and to ensure “that an application for a 
court order is filed as required by [the FAA].” Section 702(f(1)(A)-(B). These 
guidelines are known as the Attorney General’s Acquisition Guidelines. In 
addition to reiterating the targeting limitations of Section 702, these Guidelines 
provide that “[a] non-United States person reasonably believed to be located 
outside the United States may not be targeted under subsection 702(a) unless 
a significant purpose of the targeting is to acquire foreign intelligence 
information that such person possesses, is reasonably expected to receive, 
and/or is likely to communicate.” 


(U//FOUO) Finally, Section 702(g) requires the Attorney General and the 
Director of National Intelligence to submit written certifications to the FISA 
Court, either prior to the implementation of an authorization under subsection 
(a), or in the case of exigent circumstances, “as soon as practicable but in no 
event later than 7 days after such determination is made.” Section 702(g)(1)(A)- 
(B). In addition to attesting to the fact that appropriate targeting and 
minimization procedures are in place, the certifications must also include 
copies of those procedures. Unlike traditional FISA applications seeking 
authority to conduct electronic surveillance within the United States, the 
certifications are “not required to identify the specific facilities, places, 
premises, or property at which an acquisition authorized under subsection (a) 
will be directed or conducted.” 


(U//FOUO) These certifications, filed ex parte and under seal, provide 
the primary mechanism by which the FISA Court conducts its judicial 
oversight of the implementation of Section 702. See FAA, Section 702(i) 
(establishing the FISA Court’s “jurisdiction to review a certification submitted 
in accordance with subsection (g) and the targeting and minimization 
procedures adopted in accordance with subsections (d) and (e), and 
amendments to such certification or such procedures”). 38 


bl, b3, 
b7E 


38 (U//FOUO) Except as discussed elsewhere in this report, subsections (h)-(k) are not 
directly relevant to this review. In summary, those subsections address the Attorney General 
and the Director of National Intelligence's authority to direct electronic communication service 
providers to provide the government with information and protect any records pertaining to 
acquisitions made under Section 702 (Section 702(h)); judicial review of certifications and 
procedures (Section 702(i)-(j)); and the FISA Court's maintenance and security of records and 
proceedings (Section 702(k)). 


–_ 


(TS) 
b1, b3, b7E 


Each certification contains: 


(S) b1, 
b3, 
b7E 


(U//FOUO) FBI targeting and minimization procedures; 


ოი 


(TS) 
bi; 
b3, 
b7E 


c. (U//FOUO) Oversight Requirements 


(U//FOUO) Section 707 and 702() provides for extensive oversight of the 
FBI's implementation of Section 702: 


e (U//FOUO) Section 707(a) requires the Attorney General to 
submit semiannual reports to Congress that describe, among other 
things, the judicial review during the reporting period of all 
certifications and targeting and minimization procedures adopted 
under Section 702, and any instances of noncompliance with 
procedures and guidelines adopted under Section 702(d), (e), and 
(0. 


е (U//FOUO) Section 702)[()1( requires the Attorney General and the 
Director of National Intelligence to conduct semiannual 
assessments of the FBI’s compliance with their targeting and 
minimization procedures and the Attorney General’s Acquisition 


LI (TS) 
bl, b3, 
b7E 
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Guidelines. These assessments are submitted to the FISA Court 
and to Congress. 


. ક Section 702(0(2)(В) and (C) requires the Inspector General 
to review FBI acquisitions of persons later determined to be located 
in the United States and disseminations of intelligence reports 
containing a reference to a U.S. person identity. These reviews are 
submitted to Congress, the Attorney General, and the Director of 
National Intelligence. 


е (U//FOUO) Section 702()(3)(A) requires the Director of the FBI to 
conduct annual reviews of FBI acquisitions of persons later 
determined to be located in the United States and disseminations 
of intelligence reports containing a reference to a U.S. person 
identity, among other requirements. These annual reviews are 
provided to the FISA Court, the Attorney General, the Director of 
National Intelligence, and Congress. 


(U//FOUO) The OIG discusses each of these oversight requirements in 
Chapters Three and Four of this report. 


2. (U//FOUO) Sections 703 and 704 


(U//FOUO) Whereas Section 702 pertains only to non-United States 
persons reasonably believed to be outside of the United States, Sections 703 
and 704 authorize the targeting of United States persons for the acquisition of 
foreign intelligence information when those persons are reasonably believed to 
be located outside the United States. 


(U//FOUO) Section 703, codified at 50 U.S.C. § 1881b, et seq., 
addresses acquisitions of foreign intelligence information that target United 
States persons who are reasonably believed to be outside of the United States 
when the acquisition is conducted, and the acquisition “constitutes electronic 
surveillance or the acquisition of stored electronic communications or stored 
electronic data that requires an order under this Act, and such acquisition is 
conducted within the United States.” 


(U//FOUO) Section 704, codified at 50 U.S.C. § 1881c, addresses other 
acquisitions targeting United States persons outside the United States in 
circumstances where that person has a reasonable expectation of privacy anda 
warrant would be required if the acquisition occurred within the United States. 
This provision would cover, for example, the physical search of a United States 
person’s home or office outside of the United States. 


(U//FOUO) Our report is limited to the FBI’s activities under Section 
702. 
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B. (U//FOUO) Immunity Provisions 


(U//FOUO) The FAA also addresses liability relief for electronic 
communication service providers who have been alleged in various civil actions 
to have assisted the U.S. Government under the auspices of the PSP. 
Specifically, with a certification from the Attorney General, the electronic 
communication service providers may avail themselves of five statutory 
defenses, among them, that they acted pursuant to a written request or 
directive from an appropriate official indicating that the activity in question was 
authorized by the President and determined to be lawful. See FAA Section 
802(a)(1)-(5). In addition to applying retroactively, the immunity provisions of 
the FAA are not subject to sunset. 


11. (U//FOUO) The FBI’s Role and Organizational Structure Under 
Section 702 


Cae The FBI conducts two general activities under Section 702. 
First, it approves the NSA’s requests 


(S) 


sometimes called 


“selectors.” Second, the FBI (S) b1, b3, 
AA from participating providers and transmits them in the form b7E 

of raw unminimized data to the NSA and, at the NSA’s direction, to the FBI and 

the CIA.*0 In accordance with its Standard Minimization Procedures, the FBI 

retains a portion of the raw data for analysis and dissemination as finished 

intelligence products. These two basic activities, discussed in detail in 

Chapters Three and Four of this report, are carried out by personnel in the 


Counterterrorism Division's We refer to 
these personnel as the 702 Team. 


provides 


operational support to the FBI’s investigative units at Headquarters and in the bl, 


(S) ъз, 
b7E 


(S) 
b1, b3, 
b7E 


b1, b3, 
b7E 
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(S) 
bl, b3, 
b7E 
(S) 
Ы, b3, 
b7E 
bl, b3, 
ООО દિ 
(U//FOUO) The 702 Team also worked closely with attorneys from the 
Office of General Counsel’s National Security Law Branch (NSLB) during our 
review period. Among the NSLB attorneys with the most involvement in 702 
matters was one attorney who provided advice on policy matters (the Policy 
Attorney) and another who counseled the team on how the legal requirements 
of Section 702 applied to the 702 Team’s procedures (the Operations Attorney). 
In addition to the Policy and Operations Attorneys, NSLB Section Chiefs Karen 
Davis Miller and Richard McNally also had substantial participation in the 702 
Program during the review period. 
(S) 
bl, b3, 
b7E 
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IV. (U//FOUO) The FBI’s Evolving Use of Section 702 


A. (U//FOUO) The FBI’s Use of Section 702 Compared to 
Traditional FISA 


After acquiring electronic communications under Section 
702 and with the NSA’s approval, the FBI retains some of the 702 data in its 
૦ for analysis and dissemination, primarily in connection (TS) ხ), 
with its international terrorism investigations. Prior to the PAA and FAA, the b3, 
FBI obtained this type of data from traditional FISA coverage. The PAA and b7E 
FAA allowed the Intelligence Community to transition many selectors covered 
under traditional FISA to coverage under these new and more streamlined legal 
authorities. During the relevant portion of the OIG’s review period, the number 
of 702-acquired electronic communications retained by the FBI fluctuated over 
time due to policy considerations (described in Chapter Four). However, the 
overall number of such communications was substantial, and approximated 
the number of electronic communications that the FBI collected and retained 
under traditional FISA. Figure 2-1 below shows the relative parity between the 
number of electronic communications that the FBI acquired and retained 


under Section 702 from October (TS) 
2009, when the FBI began retaining 702 data in through April 2010. (TS) 


(S) b1, b3, 
b7E 


bl, 
b3, 
b7E 


SEE EE 


(TS) 


The FBI has used information collected under Section 702 in 


several national security investigations. According to senior Counterterrorism b1 
2 


41 મ The OIG compiled this chart from numerical data provided by ЕН (S) e 
CIORSECRPETSTITWORORAIEISA _ 
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Division officials, (S) bl, 
b3, 
b7E 

bl, 
(TS) 3, 
b7E 
or example, in September 2009 the NSA reported to the 

FBI that a Pakistan-based al Qaeda operative targeted under Section 702 had 

been in contact with an e-mail account that the FBI determined was being used 

by Najibullah Zazi, a legal permanent resident living in Colorado. An FBI 

investigation revealed that Zazi and two associates planned to bomb the New 

York City subway lines. FBI agents arrested Zazi On September 19, 2009, and 

in February 2010 he pleaded guilty to multiple terrorism-related charges. 

B. 187759) The FBI's Plans to Nominate Selectors for Section 702 
Coverage 
TD) The FBI plans to greatly expand its role in the 702 Program this 

year by nominating selectors for Section 702 coverage. Because the 

nominations program was still being formulated during our review period, the 

OIG was unable to review these proposed activities in depth for this report. 

However, in Chapters Three and Four we identify certain FBI policies and 

practices under the 702 Program that may be affected by the nominations 

initiative, and thus briefly summarize the nominations proposal below. 

bl, 
b3, 
b7E 
(S) 
bl, 
b3, 
b7E 


process, the FBI, and not the NSA, would be the owning agency for the 
selectors it nominates, and would assume the primary obligation to review the 
content of incoming communications to ensure that the targeted account 
remains legally eligible for 702 collection and continues to produce foreign 
intelligence information. 
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bl, b3, 
b7E 


SFR. These witnesses told us that the FBI’s nominating activities 
were expected to begin in early 2013. While finalizing this report, however, the 
OIG learned that the FBI began nominating its first selectors in April 2012. 
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(U) CHAPTER THREE 
THE FBI’S ROLE IN THE SECTION 702 TARGETING PROCESS 


In the preceding chapter, we outlined the FBI’s two primary 
functions under Section 702 of the FAA. First, after the NSA applies its 


targeting procedures and nominates a selector НИН | С) 
(S) 


the FS יו‎ 8 
sufficiency of the NSA’s foreignness 


To do so, the FBI reviews the 


b1, b3, 
determinations and (S) b7E 
. Second, for 
any Section 702-authorized acquisition from an Internet service provider (ISP), 
(S) 
he FBI acquires the targeted data from the provider, and 
transmits it in raw, unminimized form to the NSA and, at the NSA’s direction, 
to the FBI and the CIA. The FBI retains the raw data in for (5) 
analysis and, where appropriate, for dissemination as intelligence products. 
{SPINEL This chapter describes the first of these functions: the FBI's bl, b3, 
procedures for approving the targeting of selectors that have been designated b7E 
NES | უე Ll. 5 RIED 


the targeting issues discussed in this chapter, the OIG's review period is from 
September 2008, when the first ત MES (S) 
nominated to the FBI, through February 2010. 


TAANE) In Section I of this chapter, we provide a brief description of the 
procedures that governed the targeting process, including the FISA Court- 
approved targeting procedures that formed the basis for the NSA to target, and b1, b3, 
the FBI to review and approve, a selector for a (S) b7E 
Section II describes the OIG’s methodology for reviewing the FBI’s targeting 
activities. In Section III we describe the FBI’s application of its targeting 
procedures to review the sufficiency of the NSA’s foreignness determinations for 
nominated selectors. Section IV describes the FBI’s application of its targeting 
rocedures t (S) 
In Section V we describe the FBI’s procedures 
for processing selectors used by targets who had . (S) 
Section VI describes the OIG's review of FBI acquisitions of (S) 
who were later determined to be in the United 
States, a review that both the OIG and the FBI are required to conduct 
pursuant to Section 702()(2) and (3). In Section VII we provide our analysis of 
the FBI's Section 702 targeting activities during the review period. 
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I. (U//FOUO) Procedures Governing the Targeting Process 


The Section 702 targeting process - whereby a selector is 
identified for possible acquisition of communications, the foreign intelligence 
value of the acquisition is assessed, and a judgment is formed about whether 
the presumed user is a non-U.S. person reasonably believed to be located 
outside the United States - is a FISA Court-approved process in which each 
agency has well defined and distinct responsibilities. The process is 
memorialized in three primary documents: a 


the NSA's FISA Court- 
approved targeting procedures; and the FBI's FISA Court-approved targeting 


rocedures. In addition, the FBI has developed НЕ 
which are designed to translate the broad 
mandates of the and the FBI Targeting Procedures into poni] 


guidance for those members of the 702 Team who are responsible for 
conducting the FBI's targeting activities under Section 702. This section 


summarizes the relevant provisions of these documents. bl 
> 


b1, b3, 
b7E 


b1, b3, 
b7E 
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(S) 


Ы, b3, 
b7E 


(S) bl, b3, 
b7E 


(S) 


b1, b3, 
b7E 


(S) 


bl, b3, 
b7E 


(S) bl, 


b3, 
b7E 
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bl, b3, 
b7E 


SPATE The respective roles of the NSA and FBI described in the MOU 
remained largely constant through the transition from the PAA to the FAA and 


continue today. With the exception of the these roles (§)ხ1, 53, 
are made binding on the NSA and the FBI through their FISA Court-approved 7E 
targeting procedures, discussed below. 


B. (U//FOUO) Targeting Procedures Under the FAA 


Bra Pursuant to Section 702(d)(1) of the FAA, all acquisitions of 
foreign intelligence information under Section 702 are conducted pursuant to 
targeting procedures promulgated by the Attorney General in consultation with 
the Director of National Intelligence. These procedures must be “reasonably 
designed” to “ensure that any acquisition authorized under [Section 702] is 
limited to targeting persons reasonably believed to be outside the United 
States,” and to “prevent the intentional acquisition of any communication as to 
which the sender and all intended recipients are known at the time of the 
acquisition to be located in the United States.” Section 702(d)(1). 


(U//FOUO) The targeting procedures are filed as attachments to each 
certification provided to the FISA Court pursuant to Section 702(g), and are 
specifically reviewed as part of that court’s certification approval process. 
Sections 702(g)(2)(B) and 702(i)(2)-(3). The goal of the FISA Court’s review is to 
determine whether the procedures are consistent with the requirements of the 
FAA and the Fourth Amendment. 


РТ. During the OIG review period, the NSA and FBI submitted 
separate targeting procedures all (S) 
of which were approved by the FISA Court.^? These procedures, which were 
conceived of and drafted collaboratively by the relevant agency and the DOJ's 
National Security Division, serve as official representations to the FISA Court bl, 03, b7E 
about the steps each agency will take to ensure that targeting pursuant to 
Section 702 is done in a manner consistent with the authorities and 
prohibitions of the statute. The following sections summarize these 
procedures. 


43 (S) 


Ы, b3, 
b7E 


TOP 


1. (БЈР). Overview of the NSA’s Targeting Procedures 


The NSA's targeting procedures are a critical first step in the 

process because they must be applied to (s) bl, b3, 
selectors before the selectors can be nominated to the FBI. The NSA’s targeting р7Е 
procedures, which have remained substantially unchanged since the 

enactment of the FAA, address two activities directly relevant to the FBI’s role 

in the 702 program: 


૦ કસ the manner in which the NSA determines that a person 
targeted under Section 702 is a non-United States person 
reasonably believed to be located outside the United States 
(“foreignness determination”); and 


e (УЗ, the post-targeting analysis done by the NSA to 
ensure that it does not intentionally target a person known at the 
time of acquisition to be located in the United States or 
intentionally acquire any communication as to which the sender 
and all intended recipients are known at the time of acquisition to 
be located in the United States. 


(U//FOUO) NSA Targeting Procedures at 1. 


this section summarizes only those b1, b3, 
procedures relating to Internet communications. According to NSA documents b7E 
filed in support of Section 702 certifications, the term “Internet 

communications" includes communications that traverse the Internet, (TS) 


યયા The NSA targeting procedures address the targeting of 
both te 200 and Internet communications, и (TS) 


F) As to the NSA’s determination that the target is 
reasonably believed to be located outside the United States, the NSA applies a 
“totality of the circumstances” analysis based on one or more of the following: 


(TS) 


b1, b3, 
b7E 


41 TS FFNP-In addition to acquiring communications that are to or from a target, 


the NSA also “seeks to acquire communications about the target,” meaning communications in 
(Cont’d.) 
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(U//FOUO) NSA Targeting Procedures at 4. 


SASHA The NSA targeting procedures also govern the NSA's 
assessment of the foreign intelligence purpose of the targeting, which is an 
assessment of “whether the targct possesses and/or is likely to communicate 
foreign intelligence information concerning a foreign power or foreign territory. 


т 


жығы When the NSA’s post- targeting analysis reveals that a 
target has entered the United States or is a United States person, the targeting 


which the target is referred to in the content of a communication. Electronic communications 
“about” a 702 target are only collected “upstream” of U.S. providers, and the NSA has 
represented to the FISA Court that “no about communications will he obtained by acquisitions 
conducted by the FBI.” 
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procedures direct it to terminate any ongoing acquisition from the target 
“without delay” to avoid the intentional targeting of persons known to be in the 
United States. The procedures also direct the NSA to report the incident to the 
DOJ and the ODNI, and to treat the acquisition in accordance with its 
minimization procedures. In cases where the post-targeting analysis yields 
information that is unclear as to the location of a target, the NSA targeting 
procedures direct the NSA to “presume that the target has entered the United 
States” and terminate any ongoing acquisition from the target. 


2. (U//FOUO) Overview of the FBI’s Targeting Procedures 


The FBI also attaches its targeting procedures to each 
certification presented to the FISA Court for approval, and like the NSA Ы, b3, 
targeting procedures, the FBI targeting procedures remained unchanged during b7E 


the OIG's review period. These procedures, which are applied when the NSA 
nominates an account નદ address three (5) 


primary activities: 


૦ છુ the FBI’s process for acquiring foreign intelligence 
information, by targeting (s) 


electronic communications accounts designated by the NSA 


(“Designated Accounts") as being used by non-United States bl, 
persons reasonably believed to be located outside the United b3, 
States; b7E 
e (U//FOUO) the FBI”s documentation of that process; and 
e (U//FOUO) compliance and oversight. 
FBI Targeting Procedures at 1. bl, 
b3, 
b7E 


a. SHAE) The FBI’s Responsibility for Assessing the 
NSA’s Foreignness Determinations 


Consistent with the MOU, the FBI targeting procedures 
carefully circumscribe the FBI’s role in assessing the eligibility of the NSA’s 
nomination for acquisition under Section 702. The targeting procedures 
require the FBI, “in consultation with the NSA, [to] review and evaluate the 
sufficiency of: (a) NSA’s explanation for its reasonable belief that the user of 
the Designated Account is located outside of the United States; and (b) 
information provided by NSA concerning the Designated Account user’s non- 
United States person status.” Notably, the FBI’s targeting procedures do not 
state that the FBI will assess the NSA’s determination that a nomination will 


33 
TOP SECRET/TSTTTNOFORNFFISA- 


result in the acquisition of foreign intelligence information. Rather, the b1, b3, 
targeting procedures state that the “NSA will... be responsible for determining ხ7L 
that a significant purpose of the acquisition is to obtain foreign intelligence 


information,” and that the NSA will “represent [to the FBI] that a significant 
purpose of acquiring the is to 
obtain foreign intelligence information.” 


Дер. According to 702 Team personnel, the FBI interprets these 
provisions to mean that while it will review and evaluate the sufficiency of the 
NSA’s foreignness determinations, it will play no role in assessing the purpose 
of acquiring communications from a nominated account. 


SIT In addition to assessing the sufficiency of the NSA’s foreignness 
determinations, the FBI is also required under the targeting procedures to 


(S) 


(S) 
| ($) 
However, the targeting 


procedures do not obligate the FBI to conduct an independent, de novo b1, b3, 
analysis of a target's U.S. person status and location b7E 
(S) 
(S) 
bl, 
b3, 
b7E 


The result of these provisions is to make the FBI’s approval М (5) 

a default position, with denial of a request 

justified only when the FBI concludes, in consultation with the NSA, that the bl, 

NSA’s foreignness determination is not sufficient or when the FBI > b3, 
(S) b7E 


and the FBI and NSA cannot subsequently 
reach agreement about the eligibility of the account for targeting. 
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( 
“promptly advise” the FBI any time “NSA analysis of 


or other technical data, indicates that a user ofa 

. . b1, b3, 
from which were acquired by the (S) ор 
FBI pursuant to these procedures is actually located within the United States 
or is a United States person.” Upon receiving upon such notification, the FBI 
must (S 


SES that it must 


b. (U//FOUO) Documentation of the FBI's Targeting 
Activities 


Finally, the FBI targeting procedures provide that the NSA will 
(S) 


) 
(S) 


SINE. The FBI targeting procedures require the FBI to document its 


targeting activities. Specifically, the procedures require the FBI to retain the a 


information it receives from the NSA concerning each target’s U.S. person 

status and location. In addition, the FBI must (S) 
for each 

account nominated to it by the NSA. 


с. (U//FOUO) Compliance and Oversight 


4877 NEL The FBI targeting procedures contain provisions requiring the 
FBI to take specific steps to ensure compliance with and oversight of its 
targeting activities under Section 702. The FBI must develop and deliver 


training for all personnel involved in processing NSA to (S) bl, 
instruct them about their responsibilities under the statute and the targeting b3, 
procedures. The FBI’s Inspection Division is required to conduct oversight of b7E 


the FBI’s exercise of its targeting procedures, and of its training, “at least once 
every quarter.” In addition, the targeting procedures require the DOJ and 
ODNI to “evaluate the implementation of these procedures” at least once every 
sixty days. Lastly, the FBI must report any incidents of noncompliance with 
the targeting procedures by FBI personnel to the DOJ's National Security 
Division (NSD), the FBI OGC, and the ODNI Civil Liberties Protection Officer 
within five business days of learning of the incident. 


პა  _–. 


and the 


The 702 Team developed (S) 
to provide practical, step-by-step guidance to the 702 (S) 
Team about how to conduct under the FBI’s targeting 


bl, b3, 
b7E 


(S) 
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(U//FOUO) The SOPs have been in place since the PAA, well before the 
FBI began processing stored communications search requests under the FAA 
in September 2008. FBI representatives who were personally involved in the 
drafting of the original SOPs told us that the document was the result of 
collaboration between the FBI OGC and the 702 Team. Section Chief Karen 
Davis Miller of the NSLB’s Policy, Training, Litigation and Oversight Section 
stated that the SOPs were developed under then-FBI General Counsel Valerie 
Caproni’s direction, and she characterized Caproni’s concern as wanting to 
ensure that the 702 Team would have “crystal clear” directions about what 
they were to do.*5 Miller also told us that the 702 Team and the FBI OGC 
agreed that the SOPs should be drafted with compliance and future oversight 
reviews in mind. 


bl 
b3 
b7E 
The SOPs also address the 702 Team’s review of the sufficiency 
of the NSA’s foreignness determinations for nominated selectors, but do not 
provide the same level of detail for this sufficiency review 
bl 
b3 
b7E 
This form, known as the “checklist,” is used to document 
action taken under the SOPs on every selector nominated by the NSA bl 
b3 
b7E 
45 (U//FOUO) Valerie Caproni served as FBI General Counsel from August 2003 until 
her resignation from the FBI in September 2011. 
bl 
b3 
b7E 
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largely because it has been well designed to reflect MS of the (S) b7E 
operators. 


(U//FOUO) In addition to the SOPs and the checklist, the 702 Team 
views the FBI’s OGC as an important source of guidance when conducting the 
FBI’s targeting activities under Section 702. Nearly every FBI representative we 
interviewed emphasized that the 702 Team is encouraged to contact the FBI 
OGC with any questions about the statute, the targeting procedures, or the 
SOPs. 


С. (U//FOUO) The FBI’s Documentation of Its Targeting Process 


Consistent with the requirements of the FBI’s targeting 
procedures, the 702 Team has implemented a system to retain and organize 
selector-specific information provided by the NSA, the completed checklists, 
and any associated documentation. 


The core of the system is a series of paper files known as 

each of which contains all of the relevant information used 3 

the FBI when processing an NSA b1 

Each selector file contains three common elements. First, each file contains a b3 
“selector sheet.” b7E 


(S) 


(S) 


that are relevant to the FBI’s assessment 
of the NSA’s foreignness determinations. 


bl 
b3 
b7E 


(S) 


bl, 
b3, 
b7E 


(S) b1, b3, 
b7E 


(S) 
bl, b3, b7E 


II. (U//FOUO) The OIG's Methodology for Reviewing the 702 Team's 
Targeting Activities 


(U//FOUO) Before describing how the OIG conducted its review of the 
FBI's targeting procedure activities, we first summarize the oversight conducted 
by the joint NSD/ODNI compliance review teams and by the FBI’s Inspection 
Division. The results of these oversight efforts form the foundation for certain 
factual assumptions that the OIG used in conducting its review of the FBI's 
targeting activities, as described in subsection B below. 
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A. (U//FOUO) Summary of NSD/ODNI and Inspection Division 
Oversight of FBI Targeting Activities 


1. (U//FOUO) NSD Compliance Reviews 


2577989 The Attorney General is required by Section 707 to submit їо 
Congress semiannual reports concerning the FBI’s compliance with its 
targeting and minimization procedures under Section 702.47 For targeting 
activities, each Semiannual Report contains the results of NSD monthly 
compliance reviews, conducted jointly with ODNI, which document any 
compliance incidents occurring under Section 702 during the semiannual 
reporting period. A “compliance incident” generally involves a failure to comply 
with applicable targeting procedures, whether or not such failure results in an 
improper acquisition. The reviews are conducted at the NSA, CIA, and the FBI. 
During the period covered by this review, joint NSD/ODNI compliance 
assessment teams produced four semiannual reports of the FBI’s targeting and 
minimization activities under Section 702. 


(S) 


bl, b3, 
b7E 
(S) 
bl, b3, 
b7E 
કડ) officials told the OIG that based on their experience bl. 83 
conducting these reviews, the 702 Team personnel thoroughly prepared the b7E 
files for the reviews and accurately identified (S) 
(IS სხ), 03, b7E 


47 (U//FOUO) These Semiannual Reports are in addition to the Semiannual 
Assessments conducted under Section 702(0(1). As NSD officials described them, Semiannual 
Assessments provide a *30,000 foot look at the overall compliance program and the trends 
discovered related to the program." 
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A E 
In addition to reporting basic statistical information about the 
number and en the NSD/ODNI compliance reviews (S) 
we examined for this report focused closely on the 702 Team’s compliance with bl, 
its targeting procedures, with particular emphasis on ensuring that the 702 b3, 
Team fully (S) b7E 
selectors identified by the Team (S) 
bl, 
b3, 
b7E 
2. (U//FOUO) Inspection Division Quarterly Audits 
(U//FOUO) The FBI’s targeting procedures require the Inspection 
Division to conduct “periodic reviews . . . to evaluate the implementation of the 
procedures and the training given to relevant personnel.” These reviews must 
be conducted at least quarterly. 
(S) 
bl, 
b3, 
b7E 
bi 
TS ბ 
(TS) b3, 
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bl, 
(rs 53 
b7E 
877 NE} As with the NSD/ODNI compliance assessments, and consistent 
with the oversight requirement in the targeting procedures, the Inspection 
Division audits focused on whether the 702 Team adhered to it 
(S) pi ba, 
b7E 
(S) 
the compliance occurrences discussed in the Inspection Division audits 
involved errors that either had been identified and reported to NSD by the 702 
Team or discovered by NSD/ODNI assessment teams during the course of their 
oversight activities. In these instances, the audit teams primarily assessed 
whether appropriate corrective action had been taken. 
During the OIG's review period, the Inspection Division audits 
broadened to include areas that the NSD/ODNI assessments do not include. 
In November 2009, the audits began including reviews of th bl, b3, 


the FBI entity responsible for b7E 
maintaining unminimized 702 data. These audits focused on | 
compliance with its training requirements and internal procedures, including 


verifying that any improperly obtained data was purged from the FBI’s 
In February 2010, the audits began including reviews (S) 
of the compliance with its training (S) 


requirements and internal procedures as well. 


(TS) 
b1, b3, 
b7E 
₪ (S) 
b1, b3, b7E 
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(U//FOUO) The NSD/ODNI compliance assessments and Inspection 
Division audits indicate that the FBI’s rate of compliance with its targeting 
procedures is above 99 percent. 


B. (U//FOUO) OIG Methodology for Reviewing the FBI’s 
Targeting Activities 


so (TSZTSTAZNE] The OIG review team consulted with a statistician from the OIG’s bl, 


Audit Division in designing its random sample. (TS) b3, 
ורוה‎ O b7E 
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each selector in this random sample, we extracted relevant information from b1, b3, 


the and entered it into а ДИ: further analysis (પે 57: 


(TS) 


Перун Third, the OIG reviewed 


specific interest to the review, such as selectors (S) 


bl, b3, 
b7E 


selectors for which the NSA had withdrawn (S) 
For these categorical reviews, we often reviewed all or substantially all 


of the selectors of each e we could find, although for one category, the 


(U//FOUO) Fourth, the OIG requested and reviewed other relevant 
documents and information, including e-mails, ECs, internal guidance, and 
FISA Court filings that further illuminate the FBI's targeting activities during b7E 
the OIG's review period. These documents were provided by many FBI 
components, including OGC, Mena as well as by Department 
components such as NSD and the Office of Legal Counsel. 


In addition to documenta: 
members of the 702 Team, 


review, the OIG interviewed several 


b1, b3, 
b7E 


Finally, the 702 Team provided the OIG a comprehensive 
demonstration of how it applies its targeting procedures during which the OIG 3 
observed from the (S) b7E 


NSA, and had the opportunity to ask questions of members of the 702 Team as 
₪6 m ШЕН applied the FBI’s targeting procedures to EH (S) 


III. 157705] The FBI’s Application of Its Targeting Procedures: Review 
of the NSA’s Foreignness Determinations 


In this section we describe how the NSA applies its targetin 
procedures to nominate selectors to the FBI for (5 
and how those nominations are conveyed to the FBI. We then 


b1, b3, 
b7E 
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describe the FBI's preliminary review of the sufficiency of the NSA's foreignness 
determinations. 


A. 49780 Background: The NSA’s Application of its Targeting 


Procedures 
As described above, before sending a nomination ЕНЕР (S) bL. 
to the FBI, the NSA is responsible for applying its b3 
targeting procedures and determining that that the presumed user of the b7E 


nominated account is a non-U.S. person reasonably believed to be located 
outside the United States (the “foreignness determination”). In interviews with 
the OIG, NSA personnel who are directly involved in the Section 702 targeting 
process described how the NSA’s targeting procedures are implemented.5! 


b1, b3, 
b7E 


(S)b1, b3, 
b7E 


51 (U ^ 8 (U//FOUO) The от /FOUO) The OIG interviewed the following NSA personnel: the NSA's Section 
702 Tenue Lead in the NSA's Office of the Director of Compliance (ODOC); a 
Technical Director in the Signals Intelligence Directorate (SID) Special Source Operations 
group; a former Chief of the SID Oversight and Compliance group now staffed to the Monitoring 
and Assessments group of ODOC; a former Chief of PAA/FAA Procedures and Analytic Support 
Office of SID Oversight and Compliance, now also staffed to the Monitoring and Assessments 
group of ODOC; the NSA's Deputy General Counsel for Operations; and a line attorney in the 
Office of General Counsel with extensive experience with both the PAA and FAA Section 702. 
The OIG’s review benefitted substantially from the NSA's cooperation. 


52 (U//FOUO) However, the analyst does not have discretion with regard to detasking 
accounts if it is determined that the presumed user is a U.S. person or located in the United 
States. Upon recognizing such cases, NSA officials stated that the NSA detasks collection from 
the account immediately. 
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bl 
b3 
b7E 


U//FOUO) b7E 


This review includes, among other things, checking the cited source for the 
analyst’s foreignness determination to verify that the analyst has a reasonable 
basis for the foreignness assessment, and often to verify that the analyst has 


included in the foreignness explanation the most current relevant information 
available to the NSA. 


CC | 


(SPANF) The FBI’s Receipt of Nominated Selectors From the 


NSA 


(S Once the NSA has applied its targeting procedures, it forwards a 


nomination to the FBI for those selectors for which it wants a bl 


b3 


(S) b7E 


bl 
b3 
b7E 
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system called 


b7E 
| 00 אש‎ | are parts of an administrative system that 


bl, b3, 
b7E 


(S) 
b1, b3, b7E 


(575 The 702 Team most commonly uses in three ways. 


(S) 


b1, b3, b7E 


(S) 


b1, b3, b7E 
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+ ISPI After reviewing a draft of this report, the FBI told the OIG that while this 
paragraph accurately describes one use of PM during the OIG's review period, the FBI по 
longer uses ЕҢ in this manner. 


b7E 
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2.  (U//FOUO) Wawa Ms 


b1, b3, 
b7E 
b1, b3, 
(s) 978 
i (S) 3 
b7E 
(S) bl, b3, 
B b7E 
B (S) b1, b3, b7E 
в (5) 
b1, b3, 


b7E 


b1, b3, 
წ b7E 


| 


(S)  bLbs, 
b7E 


b1, b3, 
b7E 


an 
— 


(sb. b3, 


יש 
N‏ 
les]‏ 


(S) 
b1, b3, 


== 
c 
` 
tri 


(s) 91, 93, b7E 


В b3, b7E 


=a 
| 
(4%) 
— 
с сі 
cbr 
С ее 
о» 


ss (377%წე Certain identifying information relating to the targeted selector and the NSA 
analyst has been redacted from this image. 
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(TS 91, 
b3, 
b7E 


(TS) 3 
b7E 


b1, b3, 
b7E 


(S) 


b1, b3, 
b7E 


3. ДВЕ) NSA Nominations of Selectors to the FBI During 


the OIG Review Period 


F) For the review period of September 1, 2008 through 
February 28, 2010, the 702 Team identified and produced to the OIG 
selector sheets indicating that an account had been nominated by the NSA for 
a pursuant to Section 702.56 As shown in 


T 
C. ba, 
b7E 


(TS) 


b1, b3, 
b7E 


(Cont’d.) 
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АЕ: 


Figure 3-2 below, the OIG’s analysis of the bl, 
number of nominations varied from month to month, (TS) b3, 
b7E 
(TS) 
bl, b3, 
b7E 
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C. 758 FBI’s Preliminary Review of the 
Sufficiency of the NSA’s Foreignness Determination 


for }7Е 


b1, b3, 
b7E 


(S) 
bl, 
b3, 
b7E 


ва масама with the and the ЕВГз targeting 
OS th state that the SSA's review of foreignness “is Е ап 6) 

entirely separate and independent review, but rather a review to determine 

whether NSA has provided a reasonable explanation” of the presumed user’s 

location outside the United States. The therefore instruct the SSA that (S) bl, 
the SSA “can assume the facts provided are accurate (S) = E 
At the same time, the also direct the SSA to (s) 

contact the NSA for additional information if “the SSA does not agree that the 
foreignness explanation . . . is sufficient" or does not understand it, and to 

document the contact. This directive is consistent with the requirement in the 

targeting procedures that “[t]he FBI, in consultation with NSA, will review and 

evaluate the sufficiency of” the NSA's foreignness determination. 


(TS) 
81, b3, 
b7E 
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(TS) 
bi, 
b3, 


b7E 
ISTINA. Below we describe this preliminary review in more detail and 
provide select data about its implementation by the 702 Team. We focus on 
the two issues which the Lead and Assistant Program Coordinators described 
as the primary focus of the SSAs' preliminary review: the adequacy of the 
NSA's identification of the targeted selector; and the basis for the NSA's 
determination that the presumed user is a non-U.S. person reasonably believed 
to be located outside the United States. 
Review of the Selector Identification 
(TS) 
b1, b3, 
b7E 
b1, b3, 
b7E 
(TS) 
b1, b3, 
b7E 
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2. Твен) Review of the NSA’s Foreignness Determination 
(S) 


bl, 
b3, 
Below we examine the 702 Team’s review b7E 
of the NSA’s foreignness determinations, and we identify two circumstances in 
which the members of the 702 Team expressed discomfort with or raised 
questions about the NSA’s foreignness determinations: where the NSA bases 
its foreignness determination on 
ЖС. WE 
TS 
the SSA MS) 
reviews these fields to confirm that the NSA has assessed the target to be b1, b3, 
located outside the United States, and to be a non-U.S. person. (TS) b7E 
b1, b3, 
b7E 


„SHE, According to the second Unit Chief during our review b3 
period and (66 702 Team Lead and Assistant Program Coordinators, WI (S) 07 


₪ (S) 


b7E 
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(5) bl, b3, b7E 
(S) 


bl, b3, 
b7E 


(S) 


Ы, b3, 
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FISA 


bl, 
b3, 
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bl, b3, 
b7E 
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(S) b1, b3, 
b7E 
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(TS) 


81, b3, 
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Ei (TS) 
the FISA Court bL, b3, 
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b7E 


5738 Shortly thereafter, оп WE ИИ 2008, the FISA Court (TS) 
approved the first FAA Section 702 certification, and with it the NSA’s first set 
of Section 702 targeting procedures. Those targeting procedures specifically 
addressed the 


bl, 
b3, 
b7E 


bl, 
b3, 
b7E 


bl, 
b3, 
b7E 


(S) 


(TS) 
bl, b3, b7E 


noted that it had “no reason to question –__-_–--..-........ი–.-“” presumption that the vast majority of persons who 
are located overseas are not United States persons and that most of their communications are 
with other, non-United States persons, who are also located overseas.” The court called this a 
“common sense presumption.” In re Directives, Docket Number 105B(g): 07-01, at 87 &n.81 
(FISA Court, April 25, 2008). 
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(2) m Use of the PS Factor in (с) 2 
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(S) 
in РЬ 93, b7E 


(S) 


Given the 702 Team’s longstanding discomfort with 
the OIG examined how the NSA used 
its nominations to the FBI, and how the 702 Team reviewed 
that cited this factor. | 
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(S) b1, b3, 
b7E 


7680૫૪ most significant finding from this second analysis (S) a b3, 
was that we did not identify any instance among the selectors 18) b7E 
our random sample where the 702 Team requested more current foreignness 


information from the NSA based on a concern that the foreignness information 
was too 


(S) bl 
b3, 
b7E 


bl, b3, 
b7E 


— ТОР SECREFHTSIT/NOFORN/FIRA . S 


TOPS ORN/FISA 
b1, b3 
|) OO 


=>, Third, many of the 702 Team members the OIG interviewed said 
they assume that the NSA provides its strongest rationale, with its most recent 
foreignness information, when providing its foreignness explanation. Indeed, b1, b3, 
NSA officials confirmed to the OIG that the NSA includes the most recent b7E 
foreignness information available at the time of nomination, although they 


added that there are occasions when the NSA’s most recent information at the 
time of nomination is (S) 


b1, b3, b7E 


(S) 


81, b3, b7E 


Ы, b3, 
b7E 


TOPS A 


(S) 


(S) b7E 


bl 
b3 
b7E 


(S) 


The OIG does not believe that the FBI acts improperly or 
to its targeting procedures when it approves 


(S) bl 
b3 
b7E 


and we note that reliance on 


63 વઝન The DOJ/ODNI compliance assessment teams do consider the age of 
the information the NSA relies upon in tasking accounts for electronic surveillance. For bi, 


example, during a compliance review of the NSA that covered שש₪₪‎ BEEN (TS) b3, 
| the NSD/ODNI compliance b7E 
team reported that, for accounts, the NSA relied on information that vas _ (TS) 
უვ according to the report, the NSA provided 

information to the compliance assessment team for indicating that they had (165) 


been Similarly, in a чада 


review that covered TS) 
, the NSA relied on (TS) 


. The compliance (TS) 


information that was 
report did not provide further information about these 
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However, as discussed below in connection with acquisitions subsequently bl, 
determined to be improper under Section 702, the OIG found that the NSA b3, 
sometimes develops more recent information about a targeted user’s eligibility b7E 
for 702 coverage after the nomination has been submitted ИИ (S) 
Given the FBI’s obligation to review the 
sufficiency of the NSA’s foreignness determinations in consultation with the 
NSA, we believe the FBI should request the NSA to provide more current 
information in appropriate circumstances. The OIG therefore recommends that 
the FBI should consider issuing guidance advising when the 702 Team should 
seek more current information from the NSA about a targeted user’s eligibility 
for Section 702 coverage. 
3. (U//FOUO) Change to the Preliminary Review Process 
(S) 

bl, 

b3, 

b7E 
= i 

(S) 
bl, b3, 
b7E 
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IV. The FBI’s Application of its Targeting Procedures: b1, b3, b7E 
Шыныны (5) 


(БРЕ) па addition to requiring “the FBI, in consultation with Ше NSA, 


to review and evaluate the sufficiency” of the NSA’s foreignness determination, (S) ee b3, 
the FBI targeting procedures require the FBI t 7E 
(ક્‌. However, as described above, the targeting procedures do not 
require the FBI to conduct an independent, de novo analysis of a target’s 
foreignness and U.S. person status. Rather, the targeting procedures commit b1, b3, 
b7E 
Emphasis added.) The 
(S) 
(S) 
bl, b3, 
(S) b7E 


as it) b1, b3, b7E 


(S) 
It will also provide (S) 
select data about how the 702 Team has implemented this aspect of the 


targeting procedures and the И (5) 


A. Б/Е) Background: "7 


the PAA 


1. ₪ / - The FBI’s Role and "vds of Diligence When 1, b3,b7E 


According to OGC attorneys we interviewed, the FBI’s — ac 
81, b3, 
מממ‎ ana its (S) b7E 


TOP A 


This section will describe the 
was conducted during the OIG's review period, and 


TOP FISA 


dates back to the PAA, prior to the drafting of the (S) 

Section Chief Karen Davis Miller told the OIG that the FBI, at General Counsel 
Caproni’s direction, insisted that the FBI have an active role in the process for b1, b3, 
approving because the were being (S) b7E 
conducted under the FBI's authority. Caproni also told us that because (S) 


was her view at the time the first 


targeting procedures were drafted that “the FBI was раз ED (S) 
ра the FBI therefore had to “exercise due diligence.”(S) 


TE) Caproni, Miller, and the Policy Attorney each emphasized that 
“due diligence” does not require that the FBI (S) 
Caproni stated that a “presumption of regularity” applies } 3 
to the NSA’ and that “there is no reason to (S) Буг 
presume that the NSA is not upholding its constitutional duty” with respect to 
the rights of United States persons, or otherwise violating the FAA or its own 
FISA Court-approved targeting procedures. The Policy Attorney stated that the 

and other documents governing the interagency targeting process were (S) 
carefully drafted to make it clear that the FBI would only (S 


(S) 


57798. This concept of “due diligence” regarding the (S) bl, 
has been conveyed to the operators on the 702 Team, each of whom expressed b3, 
similar notions of the standard during interviews with the OIG. For example, b7E 
the Lead Program Coordinator described the Team’s standard of diligence as 
“thorough but reasonable.” 

81, b3, b7E 


TOYE) How the FEI Decided ДД რ„ 


j | 


bl, b3, b7E 
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(S) 


Ы, b3, 
b7E 
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(S) 81, b3, 
b7E 


(S) 01, 83, 
b7E 


Ы, b3, b7E 


S 
ს ы, b3, b7E 


(5) 
b1, b3, b7E 


ე > >. >> 07: 
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“SAR One reviewer we interviewed said that the memorandum assists 
in the approval process and helps streamline future audits, particularly b 
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(S) 


01, b3, b7E 


(S) 


b1, b3, b7E 


TOP 


(S) 


(S) 


(U//FOUO) After the OIG presented the above information to General 
Counsel Caproni, she stated that she was unaware of the gap in the 


procedures, called it a “mistake,” and said that the Operations Attorney should 
“fix it.” 


bl 
b3 
b7E 


bl 
b3 
b7E 


bl 
b3 
b7E 


ISA 


bl, b3, 
(5ხ7ც 
4877KR-The 702 Team ultimately approved all Mselectors.ó2 The OIG (5) 
emphasizes that, 6 ТА 
the steps the 702 Team took were entirely consistent with th (§)7L 


Nonetheless, for each of these selectors and for any other selectors processed 
by the 702 Team during the OIG review period that bore similar characteristics, 
the potential exists that the 702 Team, despite a proper application of the 


The OIG recommends, consistent with the FBI’s obligation to b1, b3, 
) БЕ 


bl, b3, b7E 
(S) 


TO I //N 


/ [SY א//‎ 


(S) 81, b3, b7E 


(S) 


81, b3, b5 
b7E 


(TS) 
bl, b3, 
b7E 


b1, b3, b7E 


70 (U//FOUO) The version of this report that has been distributed outside the 
Department of Justice contains redactions in this sentence based on the Department’s 
assertion of the attorney-client privilege. 
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b1, b3, 
b7E 


bl, b3, b7E 


(S) bl, 
b3, 
b7E 


(S) 


2 ו 


(S) 43 
b7E 


1. (U//FOUO) Relevance Judgments 


(S) 
bl, b3, 
b7E 


(S) 
bl, b3, 
b7E 


rr S ÓN 
1181 // 


) bi, b3, 


b7E 
bl, b3, 
b7E 
2. (U//FOUO) Subjects of Field Office Investigations 
b1, b3 
S 2 > 
С С Ё Кс 
(S) 
bl, 
b3, 
b7E 
7139748 These judgments must be understood in the context of the full approval 81. ხ3 b7E 
process at the FBI: they are not made unilaterally by but rather represent "CUM 
judgments of the 702 Team that in most cases have been assessed by both પણ 
and approved by an SSA. These review and approval processes are described in 
greater detail below. 
(S) 
bl, b3, b7E 
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T//SI //NOF 
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BT TRF) As noted above, the FBI’s FISA Court-approved targetin 
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rocedures require the FBI to b1, b3, b7E 
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જ. As described above, the FISA Court-a 
rocedures obligate the FBI to 


roved FBI targeting 


for (S) bl, 
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b7E 
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(TS) 


bl, b3, 
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Е} Lastly, in an October 3, 2011, Memorandum Opinion and pj ხვ b7E 
Order, the FISA Court approved an amendment to the FBI's targeting 
procedures to 
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97799 In deciding whether to approve а (S) 
the 702 Team SSAs have three possible dispositions from which to b1, b3, 
choose. One option is to approve the (S) ьт 


(S) 


b1, b3, b7E 
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located in the United States and thus not eligible for targeting under Section bl, b3, 
702. To approve a the SSA must memorialize the date and the decisio$) 5 


ee ae and then separately select “approve” in En to send an 
electronic notification to that the EEE 


However, 


ursuant to the FBI’s targeting procedures, when ye b1, b3, b7E 
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000 ` 


ფერი) One reason offered was that the NSA's targeting procedures are 
designed to identify ineligible targets before the selector is nominated to the FBI 1,3, 
for so that ineligible targets are rarely (s) b7E 
nominated in the first place. Indeed, the Lead Program Coordinator stated that 
the *NSA has done an excellent job, in my opinion, of targeting people [who] are 
overseas." 


(5) 
bl, b3, 
b7E 
კა''ე კ | 


b1, b3, b7E 


bl, 
b3, 
b6, 
b7C 
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Another factor that 702 Team members said may contribute to 


the fact that (S) 


bl, b3, 
Specifically, at least two members of the 702 Team pointed out that oe 
(S) 
The Lead Program Coordinator 
attributed this to the likelihood that the NSA (S) 
bl, b3, 
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Section 702 allows the government to acquire the 
communications of non-U.S. persons reasonably believed to be located outside 


the United States at the time of acquisition. 
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8. (U//FOUO) Other U.S. Travel Issues 
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VI. (U) Statutory Reporting Requirements for FBI Targeting Activities 


(U//FOUO) Section 702 requires the OIG to conduct three reviews of the 
FBI’s activities under the statute. One of the required reviews concerns the FBI 
targeting activities described in this chapter, and is set forth in Section 
702(0(2)(С), which provides, in relevant part: 


(U) The Inspector General of the Department of Justice and the 
Inspector General of each element of the intelligence community 
authorized to acquire foreign intelligence information under 
subsection (a) [of Section 702], with respect to the department or 
element of such Inspector General - 


(U) (C) with respect to acquisitions authorized under subsection 
(a), shall review the number of targets that were later determined 
to be located in the United States and, to the extent possible, 
whether communications of such targets were reviewed|[.] 


(U) 14.83 


(U//FOUO) The FBI is also required to conduct an annual review of the 
identical information. See Section 702()(3)(A)(iii). The importance of the FBI's 
reporting requirement to Congress was made clear by Representative Silvestre 
Reyes, who was the Chairman of the House Permanent Select Committee on 
Intelligence when Congress passed the FAA. Chairman Reyes stated: 


(U) Because of the nature of the new surveillance authorities 
granted under this bill, we were particularly concerned about the 
potential for a significant increase in the inadvertent collection of 
U.S.-person communications and information. For that reason, we 
have adopted several oversight provisions that require the 
Intelligence Community to report to Congress on the number of 
targets later determined to have been located inside the United 


83 pni The two other mandatory reviews are discussed in Chapter Four in 
connection with the OIG's discussion of the FBI's post-targeting activities. The three 
mandatory review provisions also apply to the NSA OIG because the NSA is “authorized to 
acquire foreign intelligence information" under Section 702(a). 
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States, the number of disseminated intelligence reports that 
contain U.S.-person information, and the number of disseminated 
intelligence reports that contain information identifying specific 
U.S. persons. The Intelligence Committee plans to conduct 
vigorous oversight of the reports. 


(U//FOUO) 154 Cong. Rec. H5758 (daily ed. June 20, 2008). 


(U/ /FOUO) In this section we discuss the FBI's annual review with 
respect to this acquisition issue. We then describe the OIG's review of this 
issue and provide our conclusions based on our review. 


A. (U) FBI's Annual Reporting under Section 702(1)(3)(A)(iii) 


(U//FOUO) The FBI submitted its first annual report required by 
702(1(3)(А) on March 15, 2010. The annual report was drafted by the 
Operations Attorney, and covered the period of September 1, 2008, through 
August 31, 2009 (the 2009 reporting period), effectively the first year of FBI 
operations under the FAA. The report stated: 


(S) 


Ы, b3, 
b7E 


(U//FOUO) FBI Annual Report (March 15, 2009) at 2. 


(U//FOUO) As of February 2012, when the FBI received a draft of this 
report for its review, the FBI had not submitted its second annual report, which 
will cover the period September 1, 2009, through August 31, 2010 (the 2010 
reporting period), or its third annual report, which will cover the period 
September 1, 2010, through August 31, 2011 (the 2011 reporting репод).84 


(S) 
===; mas. 7 


84 (U//FOUO) On May 22, 2012, the FBI transmitted two annual reports to Congress 
that covered the periods of September 1, 2009, to August 31, 2010, and September 1, 2010, to 
August 31, 2011, respectively. The OIG received copies of these documents but was unable to 
fully assess their contents prior to releasing this report. 
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(U//FOUO) To assist the FBI in meeting its statutory reporting 
requirements, the OIG met with senior FBI officials from the Office of General 
Counsel, Inspection Division, and Counterterrorism Division in July 2011. 
During that meeting we presented our preliminary findings concerning these 
acquisitions and explained the methodology we used to reach them. As we told 
the FBI at that time, the OIG’s analysis was based on information either within 
the FBI’s possession or readily available to it. We describe our methodology 
and findings in detail below. 
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B. (U//FOUO) OIG Review of FBI Reportable Incidents 


(S) 


bl, b3, 
b7E 
bl, 
b3, 
b7E 
S) 
b1, b3, 
b7E 
1. (U//FOUO) OIG Methodology 
(ფად) As a preliminary matter, the OIG reviewed all Section 707 
Semiannual Reports, Section 702 Semiannual Assessments, and Quarterly 
Reports to the FISA Court that covered acquisitions occurring during the OIG’s 
review period.85 These reports document compliance incidents - that is, the 
js (5) b1, b3, 
b7E 


(Cont’d.) 


117 
TOP SEC ISA 


ӨР SECRET] JSI /NOFORN/FISA_ 


NSA ог FBI’s failure to comply with а specific requirement in its targeting (ог 


minimization) procedures, whether or not the incident results in the improper bl, 
collection of 702 data. We determined that these reports did not cite an b3, 
compliance incidents attributed to the FBI that resulted in (S) b7E 
in which the user of the targeted account was in the United 

States at the time of acquisition. 

С ЗУ) The OIG and FBI reporting provisions in Section 702()(2) and 

(3) would encompass compliance incidents, but only if such incidents actually 
resulted in the acquisition The reporting provisions (S) 
also encompass other incidents that may occur in the FBI’s exercise of its 
Section 702 authority and which are not compliance incidents: J (5) bl, 
approved after the proper application of the NSA and FBI’s targeting b3, 
procedures, but which nonetheless result in the acquisition of א‎ (S) b7E 


of a person who was in the United States at the time of 
acquisition. We refer to acquisitions covered by Section 702(0(2) and (3) as 
“reportable incidents.” 
87 Е bl, b3, 
The OIG reviewed the FBI and NSA’s targeting procedures and 475 
the (29% રૂ યી to determine whether such reportable incidents must be (5) 
documented and notification to the FBI provided. The FBI’s targeting 
procedures provide: 


SNF) If NSA analysis of received from (S). -- 
the FBI, or other technical data, indicates that a user of a 
from which re 
acquired by the FBI pursuant to those procedures is actually 
located within the United States or is a United States person, the 
NSA shall promptly advise the FBI, and the FBI (S) 
at (S) 
q 7. It does not appear that the FBI and the NSA developed a formal bl, 
mechanism to implement this provision during the OIG’s review period.86 b3, 
However, the NSA’s targeting procedures more explicitly provide: b7E 
bl, b3, 
(97E 
bl, 
b3, 
b7E 
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In the event that NSA concludes that a person is 
reasonably believed to be located outside the United States and 
after targeting this person learns that the person is inside the 
United States, or if NSA concludes that a person who at the time of 
targeting was believed to be a non-United States person was in fact 
a United States person, it will take the following steps: 


57, (2) Report the incident to DOJ through the Deputy 
Assistant Attorney General in the National Security Division with 
responsibility for intelligence operations and oversight, to the ODNI 
Office of General Counsel, and to the ODNI Civil Liberties 
Protection Officer within five business days. 


Targeting A NNNM‏ מ 
Moreover, |‏ 


(S) 


provides: (s) w 3,b7E 
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SANE Witnesses stated that the FBI did not request or receive NSA 
notifications of 702 acquisitions that were later determined to be ineligible for 
702 coverage (reportable incidents) until at least October 2009, when the FBI 
began to retain 702 data for its own analysis. The 702 Team Lead Program 
Coordinator stated that the FBI first received these notifications in the form of 
purge reports after it began retaining 702 data, but only concerning accounts 
for which the FBI had requested dual routing. He and the ШЕШЕСІ: Chief b7E 
stated that the NSA subsequently began to send purge reports to the FBI 
whether or not the account was being dual routed to the FBI, although they 
could not pinpoint when this practice changed. The NSA’s Assistant Director 
for Monitoring and Assessments, Office of the Director of Oversight and 
Compliance (ODOC), told the OIG that he did not believe the FBI ever requested 
the NSA to send it notices of reportable incidents beyond those that would have 
involved accounts that had been dual routed to the FBI. 


(U//FOUO) The net effect of the gaps in this notification process was to 
leave the FBI unaware of potential reportable incidents during the OIG’s review 
period, which covers all of the FBI’s 2009 reporting period and part of its 2010 
reporting period. To determine whether this gap resulted in FBI acquisitions 
during the OIG’s review period that meet the reporting requirements of Section 
702()(2) and (3), the OIG took the following steps. 


First, the OIG obtained from the National Security Division 
the reports the NSA is required to provide under Section IV of its targeting 
procedures. These reports reflect incidents in which the appropriateness of the 
—— vas placed in doubt because the user of the targeted 
account appeared to be ineligible for 702 coverage. Each incident report b7E 
consists of a short narrative describing the NSA’s discovery through post- 


targeting analysis that a user of a targeted selector was or may have been in 
the United States during the NSA’s = הר תד‎ of the account. 


Each report involves one selector, although some selectors were involved in 
more than one incident, and thus appear in more than one report. The reports 
also describe any action the NSA took to address the incident, such as 
detasking collection and purging any tainted data. 


(TS) 
)b1, b3, b7E 
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The NSD provided the OIG with incident reports (TS) Ы, b3, 
activities. As described earlier in this (TS) ხ7L 
(TS) 


involving NSA 
chapter, most selectors tasked for 


o identify reports 


concerning selectors (TS) 


nominated to the FBI for a 


during the OIG’s (Ts) 
review period. This comparison yielded 


unique selectors. (TS) 


TINE) It is important to note that Section 702()(2) and (3) ask the OIG 


and the FBI to report on “the number of targets that were later determined to 2. 
Бе located іп the United States” that are “with respect to acquisitions” 
authorized under Section 702(a). (Emphasis added.) We therefore submitted 
this list of Sdlectors to кені { determine whether an [EA (S) 
occurred at all, and if so, when. 
Sen We asked ($0 provide the tasking histories for the ¿s b1, b3, 
selectors. Specifically, the OIG asked to provide, for each selector, whats) b7E 


action the FBI took 
the action was taken, when the provider was tasked 
and when the data from the provider wags) 
for routing to the Intelligence Community(S) 


ISHN The 


when(s) 
(S) 


returned t 


ШЖ data revealed two points critical to the OIG’s analysis. (S) 


First, many of the reportable incident-related selectors nominated for (S) 
either were not approved or were withdrawn by the NSA after the FBI had 
roved them. For these selectors, 


b1, b3, 
b7E 
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2. (U//FOUO) OIG Conclusions Regarding FBI Reportable 
Incidents 


(S) 
b1, b3, b7E 


Ы, b3, 
b7E 
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ISTINE} Review of Communications of Persons 
Later Determined to be In the United States 


b1, b3, 
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90 Sash We discuss the 702 Team’s purging procedures in Chapter Four in 
connection with the FBI’s post-targeting activities under Section 702. 
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(U//FOUO) We believe the foregoing examples illustrate how the FBI can 
use information that it already possesses or that is readily available to it to 
meet its statutory reporting requirements under Section 702(1(3)(А) (iii). 


VI. (U) OIG Analysis 
SAM In this section we present our analysis of the FBI’s targeting 


activities under Section 702 during our review period. We first assess the FBI’s 
performance of its two fundamental responsibilities under its targeting = 


procedures: to review and evaluate the sufficiency of the NSA’s foreignness 
determinations, and 1 С) Е 


We next assess the FBI’s 
special review process for (S) 


A. (U//FOUO) FBI’s Application of its Targeting Procedures 


The FBI’s FISA Court-a 


roved targeting procedures set out in 

and the standard it must meet (s) 

of selectors nominated to it under (S) 
Section 702. For each nomination, the FBI is required to fulfill two principal bl, 
obligations under its targeting procedures. First, in consultation with the NSA, b3, 
the FBI must “review and evaluate the sufficiency” of the NSA's explanation for b7E 
its reasonable belief that the presumed user of a nominated account is located 

outside the United States and its information that the user is a non-U.S. 

erson (the foreignness determination). Second, the FBI must 


(S) 


of the account 


nominated to it by the NSA. (S) 


bl, 
b3, 
b7E 
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/NO 


However, the were designed to implement the targeting procedures, and (S) bl, b3, 
thus, to assess how the FBI has met its principal obligations under the b7E 
BEBE rocedures, the OIG reviewed both the | | themselves and how the )5( 


(S) 
(57) We concluded that overall the FBI’s 702 Team has implemented 

its targeting procedures with commendable deliberation, thoroughness, and b1, b3, b7E 

professionalism. In reaching this conclusion, we took into account the FBI’s 


current limited role in the 702 Program, the fact that the 702 authority was 

new ₪ the mE of our review, the — of the (S) 
(3884) However, with regard to the FBI’s obligation to review and 

evaluate the sufficiency of the NSA’s foreignness determinations, we believe b1, b3, b7E 

there are opportunities for the FBI to improve the effectiveness of its (S) 


through increased consultation and coordination with the NSA with respect to 
nominations (S) 


OPNE] We also identified one gap in the FBI’s (S) ES 
procedures that, with little effort on the 702 Team's part, could improve the 1,53, 
The gap concerns the absence of a (5) 978 


ISP HL Before proceeding to our assessment of these substantive 
targeting issues, the OIG notes that the 702 Team’s documentation of its 
targeting activities was extremely thorough and well-organized. 


P b1,b3, 
Documentation of 


(S) ॥78 
According 


to witnesses, the need for accurate and detailed record-keeping was 
emphasized at the outset of the 702 Program by the FBI’s OGC, which 
anticipated that the FBI’s use of 702 authority would be closely scrutinized and 
undergo considerable oversight. It is evident that the 702 Team, under the 
guidance of the Lead and Assistant Program Coordinators, understood the 
importance of this function and executed it diligently. 


1. “87743. The FBI’s Review and Evaluation of the 
Sufficiency of the NSA’s Foreignness Determinations 


ઝકાસ Тһе FBI’s review and evaluation of the sufficiency of the NSA's b1, b3, 
foreignness determinations is an important step in the FBI’s b7E 
process. (S) 
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b1, b3, b7E 
ი... 9 
(S77 )- The targeting procedures do not contain a specific standard of 
diligence the FBI must employ when reviewing and evaluating the sufficiency of 
the NSA's foreignness determinations. (S) 
b1, b3, 


For example, the view of foreignness 
“is not an entirely separate and independent review, but rather a review to b7E 
determine whether NSA has provided a reasonable explanation" of the 
presumed user's location outside the United States. 


(S) 


ДУРУ We found it significant that, in balancing the FBI’s deference to 
the NSA against , both the targeting procedures (Š) ^ 1, b3, 
and th require the FBI to conduct its sufficiency review “in consultation ($) 978 
with” the NSA. (S) 


(S) 


bl, b3, 
b7E 
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(TS) 
b1, b3, 
b7E 
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(S) 


81, b3, 
b7E 


(S) 
bl, 
b3, 
b7E 


2. (STINE Reasonableness of the FBI’s нн (5) = ix 


Practices 


(S778 With regard to the FBI's obligation to the (S) 
targeting procedures are more explicit about the standard that the FBI must 
meet. The targeting procedures require the FBI to ensure that 


AST TNE) Taking into account 


nominated by the (S) 
we concluded that the (S) 


(S) b1,b3, 


required by the targeting procedures, and that the FBI met this standard of b7E 


diligence consistently throughout our review period. However, we identified 
one change to the concerning a gap in the 702 Team's (S) 
procedure that we believe can improve the quality ofthe (5) 


FBI's targeting activities at very little cost in terms of time or resources. 


b1, b3, b7E 
ма“ of 702 Team Resources ааа (5) 
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С. (0) The FBI’s Compliance with its Annual Reporting 
Requirements under Section 702(1)(3)(A)(iii) 


(U//FOUO) The FBI is required to submit annual reports to 
Congressional intelligence and judiciary committees, the Attorney General, the 
Director of National Intelligence, and the FISA Court on its Section 702 
targeting activities. Specifically, “with respect to acquisitions authorized under 
[Section 702(a)],” the FBI is required to provide “the number of targets that 
were later determined to be located in the United States and, to the extent 
possible, whether communications of such targets were reviewed[.]” Section 
702(1(3}(А) (11). The OIG refers to incidents meeting this statutory criterion as 
“reportable incidents." 
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(U//FOUO) The OIG’s review period covered all of the FBI’s 2009 
reporting period and a portion of its 2010 reporting period. The OIG’s findings 
indicate that the FBI’s reporting for the 2009 reporting period was deficient 
because we found several acquisitions that according to the data we reviewed 
met the statutory reporting criteria but which were not reported by the FBI in 
its first annual герогі,93 We could not assess the FBI's subsequent annual 
reporting because as of February 2012 that reporting had not been 
conducted. 


(U//FOUO) In an effort to assist the FBI in meeting its statutory 
reporting requirements, the OIG met with senior FBI Counterterrorism 
Division, OGC, and Inspection Division officials in July 2011 to present our 
preliminary findings and the methodology we used to reach them. We 
explained that to conduct our review, we used data either maintained by or 
readily available to the FBI. 


(S) b1, b3, 
b7E 


94 (U//FOUO) On Мау 22, 2012, the FBI transmitted two annual reports to Congress 
that covered the periods of September 1, 2009, to August 31, 2010, and September 1, 2010, to 
August 31, 2011, respectively. The OIG received copies of these documents but was unable to 
fully assess their contents prior to releasing this report. 
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(S//NF) CHAPTER FOUR 
THE FBI'S POST-TARGETING ACTIVITIES: 
ACQUISITION, ROUTING, RETENTION, MINIMIZATION, AND 
DISSEMINATION OF SECTION 702 INFORMATION 


HS AAEHInN this chapter we examine the FBI’s post-targcting activities 
under Section 702 from September 2008 through the end of April 2010. Unlike 
the activities discusscd in Chapter Three concerning the гог - (S) 

many of its post-targeting activilics did not 
commence until over a year after the FAA was enacted; most significantly, the 
FBI did not begin relaming Section 702-acquired data or disseminating it in 
intelligence reports until October 2009. 


X4S&77; NF) In Section I we provide an overview of the FBI's FISA Court- 
approved Standard Minimization Procedures for FISA electronic surveillance 
and physical search, as adapted to Section 702. In Section Il we summarizc 
how the FBI acquires 702 communications [rom participating providers and 
routes the communications within the Intelligence Community. In Section Ш 
we discuss 702 data retention issues, including a description of the FBI’s dual 
routing policies and practices and how unminimized 702 data is retained. In 
Section IV we focus оп (he dissemination process for 702-acquired information. 
In Section V we describe our review of the number of disseminated intelligence 
reports containing a reference to a U.S. person identity, as required under 
Section 702()(2)(BJ. In Section VI we provide the OIG's analysis of the FBI's 
post-targeting activities under Scction 702 during our review period. 


I. (U//FOUO)] FBI's Standard Minimization Procedures 


(U//FOUO) “Minimization” is a process designed to ensure the 
appropriate acquisition, retention, and dissemination of information 
concerning U.S. persons that is acquired under Section 702 and other 
surveillance authorities. Minimization is necessary in part because targeting 
processes may result in the acquisition of communications that are irrelevant 
to the purpose of the surveillance. Authorized personnel are responsible for 
reviewing the communications to assess whether they meet the agency's 
standards for retention and dissemination, and for memorializing these 
assessments by annotating or “marking” the acquired communications before 
they can be made more broadly available. This assessment process generally is 
referred to as “minimization,” 


(U//FOUO) Under Section 702(e) of the FAA, the Attorney General, in 
consultation with the Director of National Intelligence, must adopt 
minimization procedures for acquisitions authorized under Section 702(a). The 
minimization procedures adopted under 702 must meet the minimization 
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standards for electronic surveillance and physical search as defined in the FISA 
statute. As such, the FBI's minimization procedures must be reasonably 
designed in light of the purpose and technique of the particular electronic 
surveillance or physical search, to *minimize the acquisition and retention, and 
prohibit the dissemination, of nonpublicly available information concerning 
unconsenting United States persons consistent with the need of the United 
States to obtain, produce, and disseminate foreign intelligence information." 
See 50 U.S.C. 88 1801(h] & 1821(4). 


(U//FOUO) The FBI’s minimization procedures are reviewed and 
approved by the FISA Court as part of the government's Section 702 
certifications and serve as the primary authority governing the FBI's handling 
of raw 702-acquired information.?» The FBI's minimization procedures in effect 
during the period covered by this review are entitled “Standard Minimization 
Procedures for Electronic Surveillance and Physical Search Conducted Under 
the Foreign Intelligence Surveillance Act” (SMPs). Though designed to apply ta 
information collected under traditional FISA, the SMPs were adapted to Section 
702 through Attorney General -approved language that conforms relevant 
provisions to Section 702,96 


(5/48 Among other changes, the 702 conforming language requires 
the FBI to remove from FBI's systems the communications of “a person who at 
the time of targeling was reasonably believed to be a non-United States person 
located outside the United Stales but is in fact located inside the United States 
at the time such communication is acquired or is subsequently determined to 
be a United States person.” This amendment was necessary because the 
specific foreignness requirement of Section 702(a) (reasonable belief that a 
target is a non-U.S. person located outside the United States) is not an element 
of traditional FISA. 


{5 РАМЕ) The Attorney General adopted the SMPs aller concluding that 
they meet the requirements of the FISA statute. 


5 
45//AH The FBI's SMPs for ali in place from October ! 81 
14, 2009, when the FBI began retaining Section 702-acquired information and 3 
thus was first required to apply its minimization procedures, through April 30, 7E 


2010, the end of our review period, are identical. The SMPs are organized 


95 (SZ NE) The CIA, NSA, and FBI each receives raw Section 702-acquired information 
and is required to retain and disseminate such information in accordance with its own 
minimization procedures. The FISA Court must review and approve the minimization 
procedures of all three agencies, The FISA Court was not required to review and approve each 
agency's minimization procedures under the PAA. See РАА, Section 105C, 


"^ (U//FOUO] This Attorney General-approved language is referred to in this report as 
the “702 conforming language.” Unless olherwise indicated, references in this report to the 
SMPs in effect during our review period incorporate the 702 conforming language. 
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around three basic phases of the minimization process: acquisition, retention, 
and dissemination. Below we summarize key provisions of the FBI’s SMPs, as 
adapted 1o Section 702, and as interpreted by the FBI in relevant guidance. 


A. (U//FOUO) Acquisition 


4977 NF) The SMPs govern the acquisition, retention, and dissemination 
of nonpublicly available information concerning unconsenting United States 
persons thai the FBI obtains under traditional FISA and Section 702. The 
SMPs provide that “information acquired from electronic surveillance or 
physical search conductcd under FISA concerning United States persons may 
be uscd and disclosed by Federal officers and employees without the consent of 
the United States persons" only in accordance with the SMPs. SMPs, Section 
LB. The SMPs do not apply to publicly available information about United 
States persons or te information “acquired, retained, or disseminated with a 
United States person's consent.” In addition, with limited exceptions not 
. applicable to this report, the SMPs do not apply to information concerning non- 
United States persons. Id. 


(U//FOUO) The SMPs adopt the FISA definition of “United States 
person," which is: 


(U) a citizen of the United Statcs, an alien lawfully admitted for 
permanent residence [as defined in 8 U.S.C. 8 1101(а)(20)], an 
unincorporated association a substantial number of members of 
which are citizens of the United States or aliens lawfully admitted 
for permanent residence, or a corporation which is incorporated in 
the United States, but docs not include a corporation or an 
association which is a foreign power as defined [in 50 U.S.C, 8 
1801 {a){1}, (2), or (3)] 


(U) 50 U.S.C. 8 18016). 


tF} The SMPs also include presumptions about United Stales 
person status for purposes of implementing the SMPs. These presumptions, 
set forth below, are important because the SMPs require references to United 
States person identities to be stricken in disseminated material unless the 
information reasonably appears to be foreign intelligence information, to be 
necessary to understand foreign intelligence information or to assess its 
importance, or to be evidence of a crime: 


{Е an individual is known to be located in the United 
States, or if it is not known whether the individual is located in or 
outside of the United States, he or she should be presumed lo be a 
United States person unless the individual is identified as an alicn 
who has not been admitted for permanent residence or 
circumstances give rise to the reasonabic belief that the individual 
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is not a United States person. If an individual is known or believed 
to be located outside the United States, he or she should be 
presumed to be a non-United States person unless the individual 
is identified as a United States person or circumstances give rise 1o 
the reasonable belief that the individual is a United States person. 
In an on-line operation, if it is not known whethcr an individual is 
located in or outside of the United States, he or she should be 
presumed to be a non-United States person unless the individual 
is identified as a United States person or circumstances give rise to 
the reasonable belief that the individual is a United States person. 


(U//FOUO) SMP General Provisions, Y C. 


497-999 The SMPs provide that the FBI may acquir | (5) 
A under Section 702 only in accordance with the FBI's targeting 
procedures, as adopted by the Attorney General, in consultation with the 
Director of National Intelligence, under Section 702(d). 


{SHN The SMPs also require the FBI to “remove from FBI systems 
upon recognition” any communication acquired through targeting a person 
reasonably believed lo be outside the United States or a non-U.S. person at the 
time of targeting, but who is in fact inside the United States or a U.S. person at 
the time of acquisition.” The FBI is allowed to retain such communication only 
if the Director or Deputy Director determines in writing that the 
communication “is reasonably believed to contain significant foreign 
intelligence information, evidence of a crime that has been, is being, or is about 
to be committed, or information retained for cryptanalytic, traffic analytic, or 
signal exploitation purposes.” 


+7 Finally, the FBI is required to purge from its systems апу 
communication it has acquired and retained that is inconsistent with the 
targeting and acquisition limitations set forth in Section 702(b).?? This purging 


97 (U//FOUO] As described in Chapter Two, Subsection 702(b) provides that “(ап 
aquisition authorized under subsection |а)-” 

(U) (1) may not intentionally target any person known at the time of acquisition 

1a be located in the United States; 

(U) (2) may not intentionally target a person reasonably believed to be located 


outside the United States if the purpose of such acquisition is to target a 
particular, known person rcasonably believed 10 be in the United States; 


(I (3) may not intentionally target a United States person reasonably believed 
to be located outside the United States; 


(U) (4) may not intentionally acquire any communication as to which the sender 
and all intended recipients are known at the tirne of the acquisition to be located 
in the United States; and 


(Cont’d.) 
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requirement extends to all copies of the acquired communication that are 
accessible to any "end user electronically or in hard co 


(S) 


Bl 
B3 
B7E 


B. (U//FOUO) Retention 


(SANE) The retention provisions of the SMPs govern the storage of, 
access to, and use of FISA-acquired information within the FBI's data storage 
systems. The SMPs define “FISA-acquired information" to mean “all 
information, communications, material, or property that the FBI acquires from 
electronic surveillance or physical search conducted pursuant to FISA."98 


—S// NIO—- The SMPs restrict access to this information to “authorized 
users.” Authorized users are personnel who have been trained on the 


(U) (5) shall be conducted in a manner consistent with the fourth amendment to 
the Constitution of the United States. 


(U) FAA Section 702(b). 
95 (FSASHAMF) The SMPs also define “Raw FISA-acquired information” to mean: 


“information that (aj is in the same or substantially same format as when the 
FB] acquired it, or (b) has been processed only as necessary to render it into a 
form in which it can be evaluated to determine whether it reasonably appears to 
be foreign intelligence information, to be necessary to understand foreign 
intelligence information or to assess its importance, or to be evidence of a 
crime." 


SMPs, Section П.А, Pursuant to a PISA Couri Order dated July 22, 2002, and made 
permanent by an order dated May 19, 2004, the FBI has been allowed to share raw, or 
"unminimized," FISA-acquired data related to international terrorism with the CIA and 
the NSA for further analysis, retention, and dissemination in accordance with their own 
FISA Court-approved minimization procedures. The series of filings that led to these 
information-sharing procedures are generally known as the “Raw Take Motion" and the 
“Raw Take Order.” Prior to the Raw Take Order, the CIA and the NSA received FISA 
data collected by the ЕІ related to international terrorism “only if and when” it was 
disseminated pursuant to the FBI’s SMPs. Motion for Amended Orders Permitting 
Modified Minimization Procedures, filed with the FISA Court on May 10, 2002, under 
multiple docket numbers. 
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requirements of the SMPs and Section 702, Bl 
aksa The SMPs also require the FBI to maintain records of all B3 
personnel who have been granted access to this information and who have (s) B7E 


accessed the information. 


(ВРАЧ The SMPs provide that authorized users may access raw FISA- 
acquired information on a continuing basis unly as necessary to determine 
whether it reasonably appears to be forcign intelligence information, to be 
necessary to understand foreign intelligence information or to assess its 
importance, or to be evidence of a crime (the SMP minimization standards). 
SMPs, Section III.B. Oncc raw FISA-acquired information has been assessed 
as meeting the SMP minimization standards, the FBI may retain the 
information for further investigation and analysis, and may disserninate it in 
accordance with other SMP requirements described below. 


Bl 
B3 
B7E 


(5) wo 


?9 (U) As of May 2011, the FBI had approximately 35,437 employees, including 13,963 
special agents and 21,474 support personnel. See http: / fwww.Tbi.gov /about-us/quick facts. 
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C. (U//FOUO) Dissemination 


+7 Lastly, the SMPs govern the dissemination of FISA-acquired 
information “of or concerning United States persons,” both domestically and to 
forcign governments. The ЕВ! may disseminate FISA-acquired information 
concerning United States persons that reasonably appears to be foreign 
inteiligence information to federal, state, local, and tribal officials and agencies. 
The FBI also may disseminate, for law enforcement purposes, FISA-acquired 
information concerning United States persons that reasonably appears to be 
evidence of a crime but not foreign intelligence information, but must do so 
consistent with the rules governing access to FISA-acquired information in 
connection with criminal investigations and proceedings. The dissemination 
must also include a statement that such disclosure may only be used in a (S) 


criminal proceeding with the advance authorization of the Attorney General. 
Bl 
7 


(& NE) Disseminations of FISA-acquired information concerning United 
States persons to the governments of the United Kingdom, Canada, Australia, 
ог New Zealand require approval of the Director of the FBI or a designce. 
Disseminations of this information 1o other foreign governments also require 
the approval of the Director or a designee not lower than Section Chicf, and 
must be made in coordination with the FBI OGC. The SMPs require the FBI to 
maintain a record of all disseminations to foreign governments concerning 
United States persons and to report this information to the Attorney General or 
a designee on a quarterly basis. SMPs, Section IV.C. FBI officiais told the OIG 
that there were no disseminations to forcign governments concerning United 
States persons during the OIG's review period. 


SAHNE) Section II below describes how the FBI physically acquires 702 M 
data from participating providers and routes the data into ЕН (5) B3 
B7E 


149 


П. ДБУУ/МЕ) ЕБІ Acquisition of Section 702 Data 
(TS) 
b1, b3, b7E 


a Gc м 
1. (353 Overview о ЕШ (j b1, b3, b7E 
(S) 


bl, b3, 
b7E 


(S) 
b1, b3, 
b7E 


b1, b3, 
b7E 


b1, b3, b7E 


(S) 


81, b3, b7E 


1257754775) 1 Upstream Collection 


(TS) 
= 


 ÜSZTSHNE)| As NSA officials described to the OIG, these activities, 
sometimes called “backbone” or “upstream” collections, 
major electronic communications 
providers other than domestic providers. These major electronic 
communications providers receive Section 702(h) directives, just as the 
domestic providers do, but not for account-based information. Rather, bl, 
upstream collection ლალი ოი is capable of acquiring in-transit (TS) b3, 
communications from the Internet backbone, a major communications network b7E 
that facilitates the routing of data to or from specific e-mail accounts housed 
on provider servers. 101 


(TS) 


In addition to collecting in-transit communications to or‏ ה 
from 702 targets, the NSA also uses upstream collection to obtain‏ 
communications that reference e-mail accounts or other identifiers targeted‏ 
under Section 702 in the contents of messages, but which are not necessarily‏ 
sent or received by communicants targeted under 702. Electronic‏ 


сие А Ы, b3, 
communications “about” а 702 target аге only collected upstream of providers, 
(T 


b7E 


In 
addition, neither the FBI nor the CIA receives unminimized communications 
from the NSA’s upstream collection. FISA Court Memorandum Opinion, Oct.3, 
2011, at 18. 


TISFFSHFNE- Approximately nine percent of the total Internet 
communications that the NSA acquires under Section 702 are through b1, b3 


upstream collection. Id. at 23, n.21. કા (TS) b7E 


101 (U//FOUO) The Internet backbone is a high-speed network linking large 
metropolitan areas around the world at interconnection points called “national access points.” 
Local providers connect to the backbone through routers so that data can be carried through 
the backbone to a final destination. See Newton's Telecom Dictionary, (24th ed. 2008) 
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105 The NSA is required by its targeting procedures to conduct post-targeting 
analysis of data acquired under Section 702. 
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109 (U//FOUO) See, e.g., A Special Report, Ticking Time Bomb: Counterterrorism 
Lessons from the U.S. Government’s Failure to Prevent the Fort Hood Attack, United States 
Senate Committee on Homeland Security and Governmental Affairs, February 3, 2011. 


110 (U//FOUO) The version of this report that has been distributed outside the 
Department of Justice contains redactions in this sentence based on the Department’s 
assertion of the attorney-client privilege. 
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c. (U//FOUO) Training Authorized Users 
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b. (SANE) Purging 702 Data from „ს ” FBI ВІ 
Systems 5) B3 


B7E 


AMAR The ЕВГ SMPs require that Чапу communication acquired 
through the targeting of a person who at the time of targeting was reasonably 
believed to be a non-United States person located outside the United States but 
is in fact located inside the United States at the time such communication is 
acquired or is subsequently determined to be a United States person will be 
removed from FBI systems upon recognition... ." 
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user to contact the 702 Team so that it may review the data and determine, 


through and other analysis, whether the data in fact must be (S) 
purged. The Purge also direct the 702 Team to notify the משא‎ | ($) 


in the event it is concluded that 


(S) 
bl, b3, b7E 


bl, b3, 


b7E 
IV. Сев) FBI Dissemination of Section 702-Acquired Information 
This section examines issues related to the dissemination of 
702-acquired information, the third phase of the minimization process under 
the FBI’s SMPs. We first discuss the meaning of certain key terms that are 
used in connection with dissemination activities. We then discuss the 702 b1, b3, 
Team’s special role as case coordinator in the 702 dissemination process, as b7E 


well as how it stores disseminated reports containing 702 data in אא‎ (S) 


administrative files. We also describe the NSD/ODNI joint 702 minimization 
reviews, followed by the OIG’s assessment of the FBI’s application of its 
minimization and dissemination requirements under the SMPs and internal 
FBI guidance. 


A. (U//FOUO) Definition of Certain Terms 


(U//FOUO) Before discussing the issues surrounding the FBI’s 
application of its SMPs and related guidance to 702 disseminations, we clarify 
certain terms that are used in connection with these dissemination activities. 
These terms are also used in our statutorily mandated review of disseminated 
intelligence reports that contain a reference to a U.S. person identity, which is 
discussed in Section V of this chapter. 


1. (U//FOUO) Dissemination 
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2. (U//FOUO) Intelligence Reports 
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LANA The SMPs define “FISA-acquired information” to mean “all B7E 
information, communications, material, or property that the FBI acquires from 
electronic surveillance or physical search conducted pursuant to FISA.” SMPs, 
Section IILA, This definition is made applicable to Section 702 by the 702 
conforming language. 


S/NB According to both the Operations Attorney and NSD officials, 
*FISA-acquired information" includes both the content and metadata of 
electronic communications acquired under FISA. 


4.  (U//FOUO) U.S. Person 


(514839 Тһе SMPs adopt the definition of “United States person" used in 
the FISA statute, which provides that a “United States person” is “a citizen of 
the United States, an alien lawfully admitted for permanent residence |as 
defined in 8 U.S.C. 8 1101(a)(20]], an unincorporated association a substantial 
number of members of which are citizens of the United States or aliens lawfully 
admitted for permanent residence, or a corporation which is incorporated in 
the United States, but does not include a corporation or an association which 
is a foreign power as defined [in 50 U.S.C. 8 1801(а){1), (2), ог( 31. 50 U.S.C. 8 
1801(i. The SMPs also contain certain presumptions about U.S. person status 
(see Section ГА. of this chapter), which are reiterated in the SMP Guidelines. 


($4445 The Operations Attorney stated that the definition of U.S. 
person supplied in the FISA statute should also apply for purposes of the 
reporting provisions of Section 702(§(2) and (3). 


B. (БУЗМЕ) Role of the 702 Team іп Disseminations of 702- 
Acquired Information 
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(U//FOUO) SMP Guidelines at Section 3.5, ૬ C. 


2. (U//FOUO) The Section 702 Case Coordination Process 
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с. 487785) FBI's Application of its Standard Minimization 
Procedures to Disseminations of Section 702-Acquired 
Information | 


1. (U//FOUO) NSD and ODNI Minimization Reviews 


ЧӘР The Attorney General is required by Section 707 to submit to 
Congress semiannual reports concerning the FBI’s compliance with its 
targeting and minimization procedures under Section 702. For minimization 
activities, each Semiannual Report contains the results of NSD bi-monthly 
compliance reviews, which are conducted jointly with ODNI during the 
semiannual reporting period, documenting any compliance incidents occurring 
under Section 702. These joint NSD/ODNI compliance teams compile the 
semiannual assessments after conducting periodic targeting and minimization 
reviews at the NSA, CIA, and the FBI. Each review is written up in the form of 
an “Oversight Review Report of the Department of Justice’s National Security 
Division,” which we refer to as NSD compliance reports. 


(U//FOUO) The NSD/ODNI minimization compliance reviews are 
designed to ascertain whether the FBI is properly marking disseminated 702 
information, and whether disseminations of U.S. person information are 
performed in accordance with the SMPs and the FISA statute. 


(U//FOUO) The OIG reviewed the three NSD compliance reports that 
covered the FBI’s minimization activities through April 30, 2010. We also 
interviewed NSD attorneys who participated in the minimization reviews. 
Lastly, the OIG sought to determine whether the NSD’s reviews were likely to 
have included all relevant documents. 


a. (U//FOUO) NSD/ODNI Minimization Review 
Methodology 
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b. (U//FOUO) NSD Minimization Review Findings 
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118 (U) Under 50 U.S.C. 8 1801(е), as amended by FAA $ 110(a)(3), “foreign 
intelligence information” means 
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(U) (1) information that relates to, and if concerning a United States person is 
necessary to, the ability of the United States to protect against - 


(U) (A) actual or potential attack or other grave hostile acts of a foreign power or 
an agent of a foreign power; 


(U) (B) sabotage, international terrorism, or the international proliferation of 
weapons of mass destruction by a foreign power or an agent of a foreign power; 
or 


(U) (C) clandestine intelligence activities by an intelligence service or network of 
a foreign power or by an agent of a foreign power; or 


(U) (2) information with respect to a foreign power or foreign territory that 
relates to, and if concerning a United States person is necessary to - 


(U) (A) the national defense or the security of the United States; or 
(U) (B) the conduct of the foreign affairs of the United States. 
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120 (U//FOUO) The version of this report that has been distributed outside the 
Department of Justice contains redactions in this sentence based on the Department’s 
assertion of the attorney-client privilege. 


121 (U//FOUO) The FBI may issue National Security Letters to obtain transactional 
data and subscriber information for electronic communications upon the FBI Director or his 
designee’s certification that the “information sought is relevant to an authorized investigation 
to protect against international terrorism or clandestine intelligence activities, provided that 
such investigation of a United States person is not conducted solely upon the basis of activities 
protected by the first amendment to the Constitution of the United States.” 18 U.S.C. 

§ 2709(b). 
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V. (U) Statutory Reporting Requirements for FBI Dissemination 
Activities 


(U//FOUO) Section 702 requires the OIG and the FBI to report to 
Congress on references to U.S. person identities that are contained in 
intelligence reports that the FBI disseminates. The OIG's reporting 
requirement is set forth in Section 702(1(2)(B), which provides, in relevant part: 


(U) (B) with respect to acquisitions authorized under subsection 
(a), [the OIG] shall review the number of disseminated intelligence 
reports containing a reference to a United States-person identity 
and the number of United States-person identities subsequently 
disseminated by the element concerned in response to requests for 
identities that were not referred to by name or title in the original 
reporting[.] 


(U//FOUO) For analytical purposes, the OIG has separated the above 
provision into two issues, both of which are *with respect to acquisitions 
authorized under" Section 702(a): (1) How many intelligence reports did the 
FBI disseminate that contained a reference to a U.S. person identity; and (2) 
How many U.S. person identities did the FBI disseminate in response to 
requests to unmask such identities where they were not referred to “by name 
or title in the original reporting." 


(U//FOUO) The FBI is also required to review and report on the identical 
information. However, rather than being required to provide *a review of the 
number" of intelligence reports containing this information, the FBI is required 
to conduct “an accounting of" the number of such intelligence reports. See 
Section 702(1(3)(A)(i) & (ii). In addition, Section 702(1(3) (А) (1) requires the FBI 
to provide “a description of any procedures developed [by the Director of the 
FBI] and approved by the Director of National Intelligence to assess, in a 
manner consistent with national security, operational requirements and the 
privacy interests of United States persons, the extent to which the acquisitions 
authorized under [Section 702(a)] acquire the communications of United States 
persons, and the results of any such assessments." While the statute provides 
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no time period for the OIG’s review, the FBI is required to conduct an “annual 
review” of these issues. 


(U//FOUO) In this section we discuss the FBI’s annual reviews of these 
intelligence reporting issues. We then describe the OIG’s review of these issues 
and provide our conclusions based on our review. 


1. (U) FBI’s Annual Reporting under Section 702(0(3)(A)(i), 
(ii) and (iv) 


123 (U//FOUO) As noted above, the FBI did not submit its 2010 and 2011 annual 
reports until May 22, 2012, after it had reviewed a draft of the OIG’s report. 


124 (U//FOUO) In September 2011 the Operations Attorney moved to another position 
in the OGC and was no longer responsible for advising the 702 Team on Section 702 matters. 
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(U//FOUO) As described below, this absence of guidance was reflected 
in the varying and sometimes inconsistent approaches FBI witnesses took in 
applying the central elements of the Section 702 reporting requirements to 
specific intelligence reports we presented to them during the OIG's review. 


2. (U//FOUO) OIG Review of the Number of Disseminated 
Intelligence Reports Containing a Reference to a U.S. 
Person Identity 
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Another OGC attorney is now advising CXS on operational matters and the Operations 
Attorney is no longer responsible for drafting the FBI's annual reports. 
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125 (U//FOUO) The OIG's approach to identifying references to U.S. person identities 
for reporting purposes is similar to the approach set forth in the Attorney General Guidelines 
for Disclosure of Grand Jury and Electronic, Wire, and Oral Interception Information 
Identifying United States Persons, which instructs that to be a U.S. person identity, “the 
information must discuss or refer to the U.S. person by name (or nickname or alias), rather 
than merely including potentially identifying information such as an address or telephone 
number that requires additional investigation to associate with a particular person. The 
Guidelines further state that *in most instances it will be necessary to use the context and 
circumstances of the information pertaining to the individual in question to determine whether 
the individual is a U.S. person." Id. at p. 2. 
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This issue is of particular relevance to 702 acquisitions 
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b1, b3, 
b7E 
130 SSI ANA The Operations Attorney stated that he had discussions with NSA 
OGC attorneys regarding their view of what constitutes a reference to a U.S. person identity for 
purposes of their SMPs. He stated, “They started with the notion that [a U.S. provider domain bl, 
name] constitutes a U.S. person reference,” but that this approach proved unworkable. The b3, 
NSA's Minimization Procedures for Section 702 Acquisitions in effect during the OIG's review b7E 


period incorporate the FISA statute’s definition of “United States person,” just as the FBI’s 

SMPs do. See NSA Minimization Procedures ણણ (TS) 
However, the NSA minimization procedures provide additional guidance regarding what 
constitutes a U.S. person identity: 


ISPS FN Identification of a United States person means the name, unique 
title, address, or other personal identifier of a United States person in the 
context of activities conducted by that person or activities conducted by others 
that are related to that person. A reference to a product by brand name, or 
manufacturer's name or the use of a name in a descriptive sense, e.g., "Monroe 
Doctrine," is not an identification of a United States person. 
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3. (U//FOUO) Disseminations of Previously Undisclosed 
U.S. Person Identities 


(U//FOUO) As noted at the outset of this section, Section 702(1)(2)(B) 
also requires the OIG to review, “with respect to acquisitions authorized under 
subsection (a), . . . the number of United States-person identities subsequently 
disseminated by the element concerned in response to requests for identities 
that were not referred to by name or title in the original reporting|." The FBI 
similarly is required to provide an accounting of this same information in its 
annual reports under Section 702()(3)(A)(ii). 


(U//FOUO) The OIG requested this information from the FBI. In late 
2010, the FBI provided the following information to the OIG: 


(S) 


(U//FOUO) The Assistant Program Coordinator told the OIG in January 2011 
that the 702 Team had never been audited on this information and therefore 
had not been keeping track of it. The Operations Attorney stated that he is 
working on ideas for tracking this information on an ongoing basis so that “we 
don't have to go back and reconstruct it every year.” 
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VI. (U) OIG Analysis 


કસ In assessing the FBI’s post-targeting activities, the OIG took 
into account the fact that the FBI did not begin retaining and disseminating 
702-acquired information until October 2009, over a year after it began 
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B. (U//FOUO) Minimization and Dissemination Issues 


SE In this section we present our findings regarding the FBI’s 
application of the SMPs and FBI guidance for minimizing and disseminating 
702-acquired information. As noted, because the FBI did not begin to generate 
intelligence reports until close to the end of the OIG’s review period, our review 
of this activity is based on a relatively small number of reports. 


1. (ფენი. Maintenance of Disseminations Containing 
Section 702-Acquired Information 
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134 (U//FOUO) The version of this report that has been distributed outside the 
Department of Justice contains redactions in this sentence based on the Department's 
assertion of the attorney-client privilege. 
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annual accounting of the same information. hi 
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(U//FOUO) Based the analysis we conducted, we provide two 
observations about this reporting requirement, as well as some suggestions for 
how the FBI should approach its own statutorily required reporting obligations. 
(U//FOUO) First, the oversight and accounting objectives of Section 

702(1(2) and (3) are important and should be achieved in a timely manner. For 

this reason, we were concerned that as of February 2012, the FBI had not yet 

met its statutorily mandated annual accounting of intelligence reports that it 

disseminated as far back as December 0 136 
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b7E 


136 (U//FOUO) As noted above, the FBI did not submit its 2010 and 2011 annual 
reports until May 22, 2012, after it had reviewed a draft of the OIG’s report. 
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(U) CHAPTER FIVE 
CONCLUSIONS AND RECOMMENDATIONS 


(U//FOUO) In this chapter we present the OIG’s conclusions and 
recommendations based on our review of the FBI’s use of Section 702 authority 
through February 2010 for targeting activities and through April 2010 for post- 
targeting activities. 


I. (U) FBI Targeting Activities Under Section 702 
(7788 The OIG's review and analysis of the FBI's targeting activities 


under Section 702 during our review period is described in Chapter Three of 
this report. We assessed the FBI's performance of its two fundamental 


responsibilities under its FISA Court-approved targeting procedures: to review ი. 
and evaluate the sufficiency of the NSA’s foreignness determinations; and to 
S 
A. (U//FOUO) FBI’s Application of its Targeting Procedures 

ASTE The FBI applies its targeting procedures to accounts that have 
been nominated to it for ב‎ sl] sometimes (S) 
referred to as after the NSA has applied its own b1, b3, 
targeting procedures and concluded that the users of the accounts are non- b7E 


(S) 


U.S. persons reasonably believed to be located outside the United States. 
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Твен). To implement Ше general requirements of its targeting 
procedures, the FBI developed (S) 

which provide the 702 Team step-by-step procedures for b1, b3, 
To assess how the FBI met its principal (5) b7E 
ting procedures, the OIG 57. both the . (S) 
were applied in practice. 


(S) 
01, b3, 
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ડળ The FBI’s Review and Evaluation of the 
pes of the NSA's Foreignness Determinations 


- The FBI is required by its targeting procedures to review and 
evaluate the sufficiency of the NSA’s explanation for its reasonable belief that 


processing NSA 
obligations under the targe 
themselves and how the 


bl, b3, 
the user of the nominated account is located outside of the United States, and b7E 
the information that the NSA provides concerning the user’s non-United States 
person status (the NSA’s foreignness determination). 
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140 STFRR-The NSA’s targeting procedures remained unchanged throughout the OIG’s 
review period. 
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575, The OIG also determined that a relatively small percentage of 
NSA nominations were predicated on foreignness explanations that used data 
older than one year. FBI witnesses generally agreed that foreignness 
information that was at least 1 year old raised questions about the sufficiency 
of the NSA's foreignness explanation, yet the OIG found no indication the 702 
Team ever contacted the NSA for additional, possibly more recent information 
when asked to approve such nominations. 


7E 


Both the NSA and the FBI told the OIG that the information on 
the NSA’s selector sheets represents the most current information available to 
the NSA at the time of nomination. However, we determined through our 
statutorily mandated review of FBI that (S) 
the NSA sometimes develops more recent information about a targeted user's ы 
eligibility for 702 coverage after the nomination has been submitted (S) b3. 
Given the FBI's obligation to b7E 
review the sufficiency of the NSA's foreignness determinations in consultation 
with the NSA, we believe the FBI should request the NSA to provide more 
current information in appropriate circumstances. We believe that this 
prudential measure can be implemented with a minimum of disruption to 702 
Team operations, and in a manner that is consistent with the case-by-case 
nature of foreignness determinations. 
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B. (U//FOUO) FBI’s Compliance with its Annual Reporting 
Requirements under Section 702(1)(3)(A)(iii) 


(U//FOUO) The FBI is required to submit annual reports to Congress on 
its Section 702 targeting activities. Specifically, ^with respect to acquisitions 
authorized under [Section 702(a)]," the FBI is required to provide “the number 
of targets that were later determined to be located in the United States and, to 
the extent possible, whether communications of such targets were reviewed[.]" 
Section 702(1(3)(А)(Ш). The OIG refers to acquisitions found to be ineligible 
under Section 702 and that meet this statutory criterion as “reportable 
incidents." 


(U//FOUO) The OIG's review period covered all of the FBI's 2009 
reporting period and a portion of its 2010 reporting period. The OIG's findings 


141 (U//FOUO) On May 22, 2012, the FBI transmitted two annual reports to Congress 
that covered the 2010 and 2011 reporting periods, respectively. The OIG received copies of 
these documents but was unable to fully assess their contents prior to releasing this report. 
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indicate that the FBI’s annual report for the 2009 reporting period was 
deficient because we found several acquisitions that according to the data we 
reviewed met the statutory reporting criteria but which were not reported by 
the FBI in its first annual report. 2 
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143 (U//FOUO) As noted above, the FBI did not submit its 2010 and 2011 annual 
reports until May 22, 2012, after it had reviewed a draft of the OIG's report. 
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As the lead collection agency in the 702 Program, the NSA has the primary 
obligation to review the contents and the technical data from 702-acquired communications to 
ensure that the targeted users remain non-U.S. persons outside of the United States and 
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therefore eligible for 702 coverage. The FBI is not explicitly required by its SMPs to review the 
702 data that it retains. 
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1. (S77NE) Maintenance of Disseminations Containing 702- 
Acquired Information 
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UNCLASSIFIED 
U.S. Department of Justice 


Federal Bureau of Investigation 


Office of the General Counsel Washington, D.C. 20535 


August 17, 2012 


The Honorable Michael E. Horowitz 
Office of the Inspector General 

U.S. Department of Justice 

950 Pennsylvania Avenue, NW 
Washington, DC 20530 


(U) Dear Inspector General Horowitz: 


(U) The Federal Bureau of Investigation (FBI) appreciates the opportunity to review and 
respond to the Office of the Inspector General (OIG) audit report entitled, A Review of the 
Federal Bureau of Investigation’s Activities Under Section 702 of the Foreign Intelligence 
Surveillance Amendments Act of 2008. With respect to the OIG’s recommendations, the FBI is 
pleased to report that it is already implementing measures to resolve the issues underlying each 
and every recommendation. Enclosed are the FBI’s specific responses to the recommendations. 


(U) The FBI appreciates OIG’s oversight and independence. We were thus pleased that the 

report notes the “commendable deliberation, thoroughness, and professionalism” demonstrated 
by the FBI in its implementation of the Section 702 authority. The FBI takes pride in ensuring 
that its actions are consistent with the relevant statute and the Constitution of the United States. 


(U) On behalf of the FBI, I thank you for the professionalism your staff exhibited as they 
worked with our representatives to complete this report. If I may be of further assistance in this 
matter, please do not hesitate to contact me. 


Sin y yours, 


den) leser] 


Andrew Weissmann by PHF 
General Counsel 
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(U) FBI Responses to the OIG Recommendations in A Review of the Federal Bureau of 
Investigation’s Activities Under Section 702 of the Foreign Intelligence Surveillance 
Amendments Act of 2008 


(S) 


(U) FBI Response: The FBI concurs with this recommendation. 


(S) 


(S) 


(U) FBI Response: The FBI concurs with this recommendation. 
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(U) FBI Response: The FBI concurs with this recommendation. 


(S) 


* ck % 


(U) FBI Response: The FBI concurs in part with this recommendation. 
b1 
(S) b3 
k 1. 
b1 
b3 
(S) 


2 


SEC RN 


b1 
b3 
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БЕСНЕТУУЖОЕОБН 


(0) FBI Response: The FBI concurs with this recommendation. 
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(U) FBI Response: The FBI partially concurs with this recommendation. 
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(U) Recommendation 7: “The FBI OGC should promptly issue guidance for meeting its 
annual reporting requirements under Section 702(/)(3)(А). The guidance should define the 
phrases “with respect to” and “reference to a United States-person identity” for statutory 
reporting purposes, and clarify the circumstances under which metadata constitutes a reference to 
a U.S. person identity, so that the FBI can fulfill these annual reporting requirements in a timely 
manner.” 


(U) FBI Response: The FBI concurs with this recommendation. 
(U) The FBI intends to update its SOP to define the phrases “with respect to” and “reference to a 
United States-person identity” for statutory reporting purposes. Further, the FBI will issue 


guidance clarifying the circumstances under which metadata constitutes a reference to a U.S. 
person identity. 


U.S. Department of Justice 


National Security Division 


Office of the Assistant Attorney General Washington, D.C. 20330 
August 24, 2012 


The Honorable Michael E. Horowitz 
Inspector General 

United States Department of Justice 
Washington, D.C. 20530 


Re: Department of Justice Office of Inspector General's (OIG) A Review of the 
Federal Bureau of Investigation’s Activities Under Section 702 of the 


Foreign Intelligence Surveillance Act Amendments Act of 2008 


Dear Inspector General Horowitz: 


Thank you for the opportunity to comment on the Department of Justice Office of 
Inspector General's (OIG) 4 Review of the Federal Bureau of Investigation 5 Activities Under 
Section 702 of the Foreign Intelligence Surveillance Act Amendments Act of 2008. The scope 
and detail of this report demonstrate the thoroughness and care with which OIG has conducted 
its review of this important, and complex, program. NSD concurs with the report's finding that 
the Federal Bureau of Investigations (FBI) has "implemented its targeting procedures with 
commendable deliberation, thoroughness, and professionalism," and appreciates the 
recommendations OIG has formulated to improve the implementation of the FBI's targeting and 
minimization procedures. (U) 


NSD. in collaboration with the Office of the Director of National Intelligence (ODNI), is 
committed to ensuring that the Intelligence Community's use of section 702 is consistent with 
the law, orders of the Foreign Intelligence Surveillance Court, and the protection of the privacy 
and civil liberties of Americans. NSD and ODNI recognize the important role that your office 
serves to help ensure that section 702 authorities are implemented in a manner that reflects a 
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focused and concerted effort by FBI personnel to comply with the statute's requirements. 
Attached are NSD's responses to each of the recommendations set forth in the report. (U) 


Please let me know if NSD can be of further assistance on this or any other issue. (U) 


Sincerely, 7 


Lisa O. Monaco 
Assistant Attorney General 
for National Security 


Attachment: 
National Security Division Department of Justice Office of Inspector General's (OIG) A Review 
of the Federal Bureau of Investigation’s Activities Under Section 702 of the Foreign Intelligence 


Surveillance Act Amendments Act of 2008 
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National Security Division 
Department of Justice Office of Inspector General's (OIG) 
A Review of the Federal Bureau of [nvestigation 's Activities Under Section 702 of the 
Foreign Intelligence Surveillance Act Amendments Act of 2008. 


Recommendation 1: (U) 


(S) 


Response: (U) 


(S) 


Recommendation 2: (U) 


(S) 


Response: (U) 


NSD concurs with this recommendation. (U) 


Recommendation 3: (U) 
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ы 
(S) b3 


Response: (U) 
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Recommendation 4: (U) 
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Response: (U) 


NSD agrees that the FBI should ensure that its reporting obligations have been fulfilled 
and that the FBI should track statutorily reportable obligations as they arise. (U) 


Recommendation 5: (U) 


bl 
b3 
(S) 


Response: (U) 


NSD concurs with this recommendation. (U) 


Recommendation 6: (U) 


(S) 


Response: (U) 


(S) 
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Recommendation 7: (U) 


The FBI OGC should promptly issue guidance for meeting its annual reporting 
requirements under Section 702(1)(3)(A). The guidance should define the phrases “with respect 
to” and “reference to United States-person identity” for statutory reporting purposes, and clarify 
the circumstances under which metadata may constitute a reference to a U.S. person identity, so 
that the FBI can fulfill these annual reporting requirements in a timely manner. (U) 


Response: (U) 


NSD concurs with this recommendation. (U) 


